Maximo Application Suite CVE-2026-18517

Requires a deployment of IBM Maximo Application Suite running the optional Location Service for Esri Component (versions 9.0, 9.1, or 9.2) on Kubernetes where the shipped/misconfigured NetworkPolicy fails to restrict egress. Per CVSS PR:L, the attacker must hold some low-level privilege or workload foothold within the environment rather than being fully external; exploitation is limited to abusing the permitted outbound network paths. Limiting factors: the specific Esri location component must be installed and enabled, the cluster must rely on the affected NetworkPolicy for egress control, and the attacker needs existing in-environment access - there is no user interaction requirement (UI:N).

This is a moderate-priority issue whose CVSS 3.1 base score of 7.7 is driven largely by the Scope change (S:C) and High confidentiality impact (C:H), not by ease of attack. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation, but PR:L means an attacker must already hold some privilege/foothold within the Maximo Application Suite environment rather than being a fully external unauthenticated actor - this materially lowers real-world risk. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The core weakness (CWE-284, Improper Access Control via a misconfigured Kubernetes NetworkPolicy permitting unintended egress) is a data-exfiltration/lateral-reach enabler rather than a direct code-execution flaw: I:N and A:N confirm no integrity or availability impact. Net assessment: a legitimate configuration-hardening priority for organizations running the affected component, but not an emergency 'patch-tonight' issue given the authenticated prerequisite and absence of exploitation signals. Note the tag conflict flagged below - 'Authentication Bypass' does not match CWE-284 or the egress description and should be verified against the IBM advisory.

An attacker who has already gained a low-privilege foothold inside the Location Service for Esri Component pod/workload abuses the overly permissive Kubernetes NetworkPolicy to open outbound connections to external networks that should have been blocked. This unintended egress path is then used to exfiltrate sensitive data or reach otherwise-segmented systems. No public exploit code is known, and exploitation presupposes existing access to the clustered deployment.