CVE-2026-18537: IBM Maximo Application Suite - Location Service for Esri Component Code Execution
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
Other sources
IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Maximo Application Suite - Location Service for Esri Componentto a version that resolves this vulnerability.Fixed in 9.2.3 - Upgrade
Upgrade
IBM Maximo Application Suite - Location Service for Esri Componentto a version that resolves this vulnerability.Fixed in 9.1.13 - Upgrade
Upgrade
IBM Maximo Application Suite - Location Service for Esri Componentto a version that resolves this vulnerability.Fixed in 9.0.14
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges, as indicated by the PR:H vector. The attack can be performed over the network and does not require user interaction.
Which deployments are affected?
The affected component versions listed are 9.0, 9.1, and 9.2. The available information does not state whether a default deployment configuration is affected.
What is the impact if exploitation succeeds?
The vulnerability can result in code execution through an unsanitised container image reference in a Kubernetes operator template. The CVSS vector indicates high confidentiality and integrity impact, with no availability impact listed.