CVE-2026-18537
HighCVSS 8.7Summary
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
Risk Assessment
An attacker could exploit the unsanitised image reference to influence deployed containers, potentially leading to unauthorised or malicious images running in the cluster.
Recommendation
Update the component to a patched version and verify and restrict the container image sources used by the Kubernetes operator.
Other vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
See all- CVE-2026-18529High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
- CVE-2026-18517High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
- CVE-2026-18513High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Original NVD description (English source)
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS