CVE-2026-18531CWE-330

CVE-2026-18531

Medium · published August 5, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2026-08-05T20:16Z
Affected products (3)
ProductVersionsFixed in
ibm/maximo_application_suite≥ 9.0, < 9.0.289.0.28
ibm/maximo_application_suite≥ 9.1, < 9.1.209.1.20
ibm/maximo_application_suiteall versions—
References (1)
https://www.ibm.com/support/pages/node/7282362 · [email protected]
EPSS history
Timeline
  • 05 AUG 16:04Z
    IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
    cvelistv5