CVE-2026-105052: IBM Maximo Application Suite Information Disclosure

Q: Which deployments are affected?

IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2 are identified as affected.

Q: What does an attacker need to exploit this issue?

The issue can be exploited remotely by sending a specially crafted URL containing directory-traversal sequences such as /../. No privileges or user interaction are required according to the supplied severity vector.

Q: What could an attacker access?

A successful exploit may allow the attacker to view arbitrary files on the system. The provided information describes an information-disclosure impact and does not indicate file modification or service disruption.

Published Oct 3, 2026

Updated

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Other sources

Maximo Application Suite could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

— IBM

Affected Software

6 affected components

IBM Maximo Application Suite=8.10, =8.11, =9.0, =9.1, =9.2

IBM Maximo Application Suite<=8.10

IBM Maximo Application Suite<=8.11

IBM Maximo Application Suite<=9.0

IBM Maximo Application Suite<=9.1

IBM Maximo Application Suite<=9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Maximo Application Suite to a version that resolves this vulnerability.
Fixed in 8.10.37
Upgrade
Upgrade IBM Maximo Application Suite CoreIdp to a version that resolves this vulnerability.
Fixed in 3.2.201
Upgrade
Upgrade IBM Maximo Application Suite to a version that resolves this vulnerability.
Fixed in 8.11.34
Upgrade
Upgrade IBM Maximo Application Suite CoreIdp to a version that resolves this vulnerability.
Fixed in 4.0.179
Upgrade
Upgrade IBM Maximo Application Suite to a version that resolves this vulnerability.
Fixed in 9.0.32
Upgrade
Upgrade IBM Maximo Application Suite CoreIdp to a version that resolves this vulnerability.
Fixed in 5.1.148
Upgrade
Upgrade IBM Maximo Application Suite to a version that resolves this vulnerability.
Fixed in 9.1.26
Upgrade
Upgrade IBM Maximo Application Suite CoreIdp to a version that resolves this vulnerability.
Fixed in 6.3.60
Upgrade
Upgrade IBM Maximo Application Suite to a version that resolves this vulnerability.
Fixed in 9.2.7
Upgrade
Upgrade IBM Maximo Application Suite CoreIdp to a version that resolves this vulnerability.
Fixed in 8.1.36

Event History

Oct 3, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 12, 2026

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7290791

Frequently Asked Questions

Which deployments are affected?

IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2 are identified as affected.

What does an attacker need to exploit this issue?

The issue can be exploited remotely by sending a specially crafted URL containing directory-traversal sequences such as /../. No privileges or user interaction are required according to the supplied severity vector.

What could an attacker access?

A successful exploit may allow the attacker to view arbitrary files on the system. The provided information describes an information-disclosure impact and does not indicate file modification or service disruption.

CVE-2026-105052: IBM Maximo Application Suite Information Disclosure

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker access?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker access?