What’s Vulnerable › Products

IBM Maximo Application Suite vulnerabilities

35 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your IBM Maximo Application Suite version is affected

Latest IBM Maximo Application Suite vulnerabilities

• CVE-2026-105052 — IBM Maximo Application Suite Information Disclosure (CVSS 7.5)
• CVE-2026-18531 — IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret (CVSS 5.3)
• CVE-2026-15656 — IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret (CVSS 4.3)
• CVE-2026-4820 — IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag (CVSS 4.3)
• CVE-2025-14684 — IBM Maximo Application Suite - Monitor Component uses Log Forging which is vulnerable to . (CVSS 3.3)
• CVE-2025-36386 — There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics (CVSS 9.8)
• CVE-2025-2898 — IBM Maximo Application Suite privilege escalation (CVSS 8.8)
• CVE-2023-43037 — IBM Maximo Application Suite improper access control (CVSS 6.5)
• CVE-2025-1500 — IBM Maximo Application Suite file upload (CVSS 8.0)
• CVE-2024-35150 — IBM Maximo Application Suite log manipulation (CVSS 5.3)
• CVE-2024-35148 — IBM Maximo Application Suite SQL injection (CVSS 8.8)
• CVE-2024-35145 — IBM Maximo Application Suite cross-site scripting (CVSS 6.1)
• CVE-2024-35144 — IBM Maximo Application Suite information disclosure (CVSS 5.3)
• CVE-2024-35146 — IBM Maximo Application Suite cross-site scripting (CVSS 5.4)
• CVE-2024-38314 — IBM Maximo Application Suite - Monitor Component information disclosure (CVSS 5.9)
• CVE-2024-37068 — IBM Maximo Application Suite information disclosure (CVSS 7.5)
• CVE-2024-22333 — IBM Maximo Application Suite information disclosure (CVSS 3.3)
• CVE-2024-22328 — IBM Maximo Application Suite information disclosure (CVSS 7.5)
• CVE-2024-27266 — IBM Maximo Application Suite XML external entity injection (CVSS 8.2)
• CVE-2023-38723 — Maximo Asset Management cross-site scripting (CVSS 6.4)
• CVE-2023-32335 — IBM Maximo Application Suite information disclosure (CVSS 7.5)
• CVE-2023-47718 — IBM Maximo Asset Management cross-site request forgery (CVSS 8.8)
• CVE-2023-32337 — IBM Maximo Spatial Asset Management server-side request forgery (CVSS 5.4)
• CVE-2023-32332 — IBM Maximo Application Suite and IBM Maximo Asset Management HTML injection (CVSS 5.4)
• CVE-2023-32334 — IBM Maximo Asset Management information disclosure (CVSS 5.3)