Critical · published October 28, 2025
🚨 A clever bypass means an attacker can waltz right past authentication in IBM Maximo, gaining access without breaking a sweat! 🔥 Think of this vulnerability as a poorly secured VIP entrance at a concert where anyone can slip in without a ticket — no bouncer in sight! 🎟️ With this vulnerability, an attacker could gain unauthorized access to sensitive application data, potentially leading to data leaks, unauthorized changes, or even complete control of the application. This could be absolutely devastating for your organization’s security posture!
Think of this vulnerability as a poorly secured VIP entrance at a concert where anyone can slip in without a ticket — no bouncer in sight! 🎟️ CVE-2025-36386 allows remote attackers to bypass authentication mechanisms in IBM Maximo Application Suite versions 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4, granting them unauthorized access to the application without needing valid credentials.
With this vulnerability, an attacker could gain unauthorized access to sensitive application data, potentially leading to data leaks, unauthorized changes, or even complete control of the application. This could be absolutely devastating for your organization’s security posture! Immediate action is essential: update your IBM Maximo Application Suite to the latest version available. Ensure that all authentication mechanisms are reviewed and enhanced to prevent unauthorized access. Don't forget to audit current access controls! You've got this! Secure your applications, and you'll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ibm/maximo_application_suite | ≥ 9.0, ≤ 9.0.15 | — |
| ibm/maximo_application_suite | ≥ 9.1.0, ≤ 9.1.4 | — |