Maximo Application Suite CVE-2026-18531

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication, no privileged access, and no user interaction - only network-reachable access to the Maximo Application Suite web interface on an affected version. Because this is a product-level flaw in how the HMAC secret is generated rather than an optional configuration setting, all installations of versions 9.0, 9.1, and 9.2 are implicitly vulnerable until patched; no special deployment mode or feature flag is required to be exposed. Exploitation is constrained by the need for the attacker to deduce or brute-force the HMAC secret, which requires traffic observation, cryptanalytic effort, or prior knowledge of a weak default value - this raises practical complexity above the vendor-rated AC:L in most real environments. Scope is unchanged (S:U), meaning successful exploitation does not directly pivot to systems beyond the Maximo session layer.

The vendor-assigned CVSS 3.1 score of 5.3 Medium reflects network accessibility (AV:N), low attack complexity as rated (AC:L), no authentication (PR:N), and no user interaction (UI:N), but constrains impact to low integrity only (I:L, C:N, A:N) with no scope change (S:U). Independent assessment raises Attack Complexity to High, since exploiting a weak HMAC secret - even an insufficiently random one - typically requires analytical or computational effort to recover the key, which is not trivially low complexity unless the secret is a hardcoded or known-default value; the description does not disambiguate between these scenarios. The 'Information Disclosure' tag conflicts with the CVSS C:N rating and is unresolved in the available data. EPSS score is absent from the provided intelligence and cannot be assessed. The vulnerability is not listed in CISA KEV and no public exploit code is known, making opportunistic mass exploitation unlikely at this time. Real-world risk is moderate: the attack surface is broad (network-reachable, no authentication required), but actual impact is bounded to session-layer integrity tampering and the attacker must invest effort to recover the signing secret. Internet-exposed Maximo deployments represent the highest-priority remediation targets.

An attacker with network access to an affected Maximo Application Suite instance collects session tokens from observed HTTP traffic or by authenticating with a legitimate low-privilege account, then applies cryptanalytic or brute-force techniques against the weak HMAC secret (CWE-330) to derive the signing key. With the key recovered, the attacker constructs a forged session payload - potentially altering user identity, role, or application-state attributes - computes a valid HMAC signature, and submits the crafted token to the server, which accepts it as legitimate. No public proof-of-concept exploit code has been identified at time of analysis.