CVE-2026-18529: IBM Maximo Application Suite - Location Service for Esri Component Code Execution
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
Other sources
IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Maximo Application Suite - Location Service for Esri Componentto a version that resolves this vulnerability.Fixed in 9.2.3 - Upgrade
Upgrade
IBM Maximo Application Suite - Location Service for Esri Componentto a version that resolves this vulnerability.Fixed in 9.1.13 - Upgrade
Upgrade
IBM Maximo Application Suite - Location Service for Esri Componentto a version that resolves this vulnerability.Fixed in 9.0.14
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs high privileges. The attack can be performed over the network with low complexity and does not require user interaction.
What could a successful exploit affect?
Successful exploitation can have high confidentiality and integrity impact, and the scope can extend beyond the initially affected security authority. The availability impact is rated as none.