What is the CVSS score of CVE-2026-15656?

CVE-2026-15656 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-15656?

Yes, a patch is available for CVE-2026-15656. Update the affected software to the latest version immediately.

IBM Maximo Application Suite CVE-2026-15656

EUVD-2026-53444 MEDIUM

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614)

2026-08-05 ibm

GHSA-c4w8-xh9q-53gh

Information Disclosure IBM Maximo Application Suite

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Attacker controls the HTTP endpoint receiving the cookie, so no network sniffing position is needed; only the session cookie value is directly exposed.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:42 vuln.today

DescriptionCVE.org

IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

AnalysisAI

IBM Maximo Application Suite 9.0, 9.1, and 9.2 fails to set the Secure attribute on authorization tokens and session cookies, enabling interception of credential material over unencrypted HTTP. An attacker who tricks an authenticated user into following an HTTP link - via phishing or a malicious page - causes the victim's browser to transmit the session cookie in plaintext, where it can be captured by a server the attacker controls or via network sniffing. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, session token theft can lead to full account takeover, meaningfully exceeding the limited confidentiality scope implied by the raw CVSS score.

Technical ContextAI

CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute) describes the root cause: the Secure flag instructs browsers to transmit a cookie only over encrypted HTTPS connections; its absence means the cookie is included in any HTTP request to the same host, regardless of whether the application normally runs over HTTPS. IBM Maximo Application Suite (MAS) is an enterprise-grade asset management platform built on a cloud-native architecture, typically deployed for industrial, facilities, and infrastructure management. Affected versions span 9.0, 9.1, and 9.2 (CPE: cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*). Because MAS issues both authorization tokens and session cookies without this flag, any HTTP-initiated request from an authenticated session - even one triggered by a redirect or embedded resource - leaks the credential to the receiving endpoint or to a passive network observer.

RemediationAI

A patch is available from IBM; consult the vendor advisory at https://www.ibm.com/support/pages/node/7282362 for the specific fix version and upgrade procedure - the exact patched version number was not provided in the available intelligence data and should be confirmed directly with IBM before deployment. As a compensating control prior to patching, enforce HTTP Strict Transport Security (HSTS) with a sufficiently long max-age directive on all MAS endpoints, which instructs compliant browsers to refuse plain HTTP connections to the domain entirely, preventing cookie transmission over HTTP even when users follow HTTP links - note that HSTS requires valid TLS configuration and takes effect only after the first successful HTTPS connection. Additionally, configure network egress controls or web application firewall rules to block or redirect inbound HTTP (port 80) requests to the Maximo application server, denying the protocol path the attack depends on. Organizations should also review cookie configuration across all MAS components to confirm both the Secure and HttpOnly flags are set post-patch.