CVE-2026-18529
HighCVSS 8.7Summary
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
Risk Assessment
An attacker could execute arbitrary commands in the context of the Kubernetes operator, potentially leading to cluster takeover or access to sensitive data.
Recommendation
Update the component to a patched version and avoid passing unsanitised user input to shell commands in operator tasks.
Other vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
See all- CVE-2026-18537High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
- CVE-2026-18517High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
- CVE-2026-18513High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Original NVD description (English source)
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS