IBM Maximo Application Suite CVE-2026-18513

Exploitation requires an attacker to already hold high privileges (PR:H) inside an environment running IBM Maximo Application Suite with the Location Service for Esri component (versions 9.0, 9.1, or 9.2) deployed on its Kubernetes/OpenShift platform. The specific prerequisite is the presence of the schema-less Custom Resource Definition, which performs no input validation; the attacker must be able to submit or modify custom resources against that CRD. Limiting factors: the high-privilege requirement excludes anonymous/low-privilege remote attackers, the affected Esri Location Service is an optional specialized component not present in every Maximo deployment, and only the three named 9.x versions are indicated as affected. No user interaction is required (UI:N).

This is a moderate-priority, high-barrier issue rather than an urgent widespread threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) scores HIGH primarily because of the full C/I/A impact, but the decisive mitigating factor is PR:H - exploitation requires an attacker to already hold high privileges within the environment, substantially shrinking the realistic threat population to insiders or attackers who have already compromised a privileged account. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no signal of active or probable exploitation - the risk is driven entirely by theoretical impact, not observed activity. SSVC framing would likely land at exploitation:none, automatable:no (requires existing high privilege, not mass-automatable), technical impact:total. The CWE-269 (Improper Privilege Management) classification combined with the 'schema-less Custom Resource Definition' description is internally consistent: an unvalidated CRD in the underlying Kubernetes/OpenShift layer lets an already-privileged actor manipulate resources beyond intended bounds. Net: a genuine privilege-management defect worth patching in affected deployments, but not a drop-everything issue absent any exploitation evidence.

An attacker who has already obtained a high-privilege account or service credential within the IBM Maximo Application Suite / OpenShift environment leverages the schema-less Custom Resource Definition in the Location Service for Esri component to submit unvalidated custom resources, bypassing intended access controls to read, alter, or disrupt protected data and services. Because PR:H is required, this is realistically an insider or post-compromise lateral/privilege-escalation step rather than an initial intrusion vector. No public exploit code was identified at the time of analysis.