CVE-2026-18517
HighCVSS 7.7Summary
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
Risk Assessment
Unintended egress could expose data or enable communication with unauthorised external resources, violating network isolation policies.
Recommendation
Update the component to a patched version and review and correct the NetworkPolicy configuration in the Kubernetes cluster.
Other vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
See all- CVE-2026-18537High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
- CVE-2026-18529High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
- CVE-2026-18513High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Original NVD description (English source)
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS