Maximo Application Suite CVE-2025-36386

The attacker needs network reachability to the Maximo Application Suite web interface and a target running an affected version (9.0.0 through 9.0.15, or 9.1.0 through 9.1.4). Per CVSS PR:N/UI:N, no credentials and no user interaction are required, so default deployments are exploitable by an unauthenticated remote attacker. The primary limiting factor is exposure: Maximo Suite is typically an internal enterprise/OpenShift-hosted application, so risk is highest where the instance is internet-facing or reachable by a broad internal attacker population; the exact vulnerable feature or authentication flow is not specified in the advisory data provided.

This is a genuinely high-priority flaw, not a CVSS-inflation case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated authentication bypass - the most dangerous class because it removes the primary control gating all downstream access. CWE-305 (Authentication Bypass by Primary Weakness) is consistent with the description of a remote attacker bypassing authentication to reach the application. However, several exploitation signals are absent from the provided data: no EPSS probability score, no CISA KEV listing, and no public POC are present, so there is no evidence of active or imminent mass exploitation - the priority rests on intrinsic severity rather than observed activity. One caveat worth verifying: the description states only that the attacker gains 'unauthorized access to the application,' which cleanly supports C:H and I:H, but A:H (full availability impact) is a slightly generous scoring choice not explicitly justified by the text; the practical impact may be centered on confidentiality/integrity of app access. Net: treat as an urgent patch item given the unauthenticated remote profile, while recognizing the exploitation-status signals are simply missing rather than negative.

A remote attacker with network reachability to a Maximo Application Suite instance (9.0.0-9.0.15 or 9.1.0-9.1.4) sends crafted requests that circumvent the authentication mechanism, obtaining application access without valid credentials. No public exploit code is identified at time of analysis, but the low-complexity, no-interaction, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) means a working exploit would be broadly and repeatably usable once developed.