IBM Maximo CVE-2026-18533

Exploitation requires privileged access to the Maximo Application Suite environment sufficient to supply or alter the container image configuration within the Kubernetes operator template for the Location Service for Esri component (CWE-94). The input is improperly validated/unsanitised, so a crafted image/config value is injected and later deployed by the operator. Limiting factors: the attacker needs high privileges (CVSS PR:H) over the operator configuration, the affected component is the optional Esri Location Service (not a default/core Maximo function), and only suite versions 9.0, 9.1, and 9.2 are listed as affected; no end-user interaction is required.

CVSS 3.1 base is 6.5 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. The network vector and low attack complexity are tempered by PR:H, which here means the attacker must already be able to supply or modify the container image configuration consumed by the Kubernetes operator template - an operator/administrator-level capability. No EPSS probability, CISA KEV listing, SSVC data, or public POC was provided, so there is no evidence of widespread or automated exploitation; at time of analysis there is no public exploit identified. The CWE-94 code-injection nature with High confidentiality and integrity impact makes this genuinely dangerous once operator access exists, but the privilege precondition plus the optional/niche Esri Location Service component keep this a conditional, insider-or-post-compromise risk rather than a remotely mass-exploitable flaw. The missing EPSS/KEV/POC signals reflect absent intelligence sources, not confirmed low risk, and should not be mistaken for a low-priority verdict on their own.

An attacker or malicious insider who already holds privileged access to the Maximo Application Suite deployment supplies a crafted, unsanitised container image value into the Kubernetes operator template for the Esri Location Service. When the operator reconciles the template, the injected image/configuration is deployed and attacker-controlled code executes within the cluster. No public exploit code was identified at time of analysis.