CVE-2026-75881: IBM Maximo Application Suite - IoT Component Denial of Service

Q: What access does an attacker need to trigger the denial of service?

The issue is remotely exploitable and requires no privileges or user interaction. An attacker needs to provide certain inputs that trigger an infinite parsing loop.

Q: Which deployments are known to be affected?

IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 are identified as affected.

Q: What is the expected impact of successful exploitation?

Successful exploitation can cause a denial of service. The supplied severity vector indicates no confidentiality or integrity impact, with availability impact rated high.

Published Sep 30, 2026

Updated

IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.

Other sources

IBM Maximo Application Suite - IoT Component could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.

— IBM

Affected Software

4 affected components

IBM Maximo Application Suite - IoT Component=9.2.0, =9.1.0, =9.0.0

IBM Maximo Application Suite - IoT Component<=9.2.0

IBM Maximo Application Suite - IoT Component<=9.1.0

IBM Maximo Application Suite - IoT Component<=9.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Maximo Application Suite - IoT Component to a version that resolves this vulnerability.
Fixed in 9.2.3
Upgrade
Upgrade IBM Maximo Application Suite - IoT Component to a version that resolves this vulnerability.
Fixed in 9.1.15
Upgrade
Upgrade IBM Maximo Application Suite - IoT Component to a version that resolves this vulnerability.
Fixed in 9.0.24

Event History

Sep 30, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 12, 2026

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7290173

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

The issue is remotely exploitable and requires no privileges or user interaction. An attacker needs to provide certain inputs that trigger an infinite parsing loop.

Which deployments are known to be affected?

IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 are identified as affected.

What is the expected impact of successful exploitation?

Successful exploitation can cause a denial of service. The supplied severity vector indicates no confidentiality or integrity impact, with availability impact rated high.

CVE-2026-75881: IBM Maximo Application Suite - IoT Component Denial of Service

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

Which deployments are known to be affected?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

Which deployments are known to be affected?

What is the expected impact of successful exploitation?