What is the CVSS score of CVE-2026-18531?

CVE-2026-18531 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-18531?

Yes, a patch is available for CVE-2026-18531. Update the affected software to the latest version immediately.

Maximo Application Suite CVE-2026-18531

EUVD-2026-53443 MEDIUM

Use of Insufficiently Random Values (CWE-330)

2026-08-05 ibm

GHSA-fjm9-fv2r-mxmv

Information Disclosure IBM Maximo Application Suite

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

AC raised to High because recovering a weak but non-trivially predictable HMAC secret requires computational or analytical effort; all other vendor metrics are independently consistent with the description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:42 vuln.today

DescriptionCVE.org

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret.

AnalysisAI

Session data tampering in IBM Maximo Application Suite 9.0, 9.1, and 9.2 is possible because the application signs session tokens with a weak HMAC secret, classified under CWE-330 (Use of Insufficiently Random Values). A remote unauthenticated attacker who can derive or predict the HMAC signing key may forge or modify session tokens, undermining session integrity across affected deployments. No public exploit code has been identified, this vulnerability is not listed in the CISA KEV catalog, and a vendor patch is available via IBM's advisory.

Technical ContextAI

IBM Maximo Application Suite is an enterprise asset management platform (CPE: cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*) used to manage physical infrastructure, industrial equipment, and IT assets at scale. Session integrity in web applications depends on an HMAC-signed token whose security is entirely contingent on the entropy and secrecy of the signing key. CWE-330 (Use of Insufficiently Random Values) identifies the root cause: the HMAC secret lacks sufficient randomness or strength, making it feasible for an attacker to derive, guess, or brute-force the value. Once the key is recovered, any standard HMAC library can regenerate a valid signature over a crafted session payload, bypassing the server's authenticity check entirely. Notably, the 'Information Disclosure' tag in the source intelligence conflicts with the CVSS C:N metric; if tampered session tokens expose or reveal user identity or role attributes, the confidentiality impact may be underrepresented and should be confirmed against the vendor advisory.

RemediationAI

Apply the vendor-released patch per IBM's security advisory at https://www.ibm.com/support/pages/node/7282362. The exact fixed version number is not specified in the available intelligence and must be retrieved from the advisory to confirm the target upgrade version for 9.0, 9.1, or 9.2 deployments. As a compensating control while patching is being scheduled, restrict network access to Maximo Application Suite endpoints to trusted internal networks via firewall rules or VPN gateway, directly narrowing the attack surface given the CVSS AV:N vector. Enabling short session timeouts and aggressive server-side session invalidation limits the window during which any successfully forged token remains usable. These controls do not eliminate the underlying weak HMAC secret but raise the cost of successful exploitation. Rotating all session signing secrets to cryptographically strong, randomly generated values after applying the patch should be confirmed as part of the upgrade process.