Maximo Application Suite EUVD-2026-18068

While the CVSS score of 4.3 is relatively moderate, the real-world risk warrants attention due to several factors. The attack vector is network-based and requires no special complexity, but critically depends on user interaction (UI:R) - an attacker must socially engineer a user to click an HTTP link or visit a compromised site, which reduces the attack surface in mature organizations with security awareness training. The CVSS vector indicates low confidentiality impact (C:L), no integrity impact, and no availability impact, making this primarily an information disclosure issue. The lack of reported active exploitation (KEV status not indicated as 'YES' in input) and absence of public exploit code suggest this is not an immediate priority compared to more easily exploitable vulnerabilities. However, in enterprise environments where Maximo is deployed and users frequently click links from email or untrusted sources, the risk becomes more tangible. The vulnerability is straightforward to remediate and vendors have released patches, shifting this from a critical business risk to a hygiene issue requiring routine patching cycles.

An attacker sends a phishing email to a Maximo Application Suite user containing a link to http://maximo.company.com/dashboard (unencrypted HTTP). Alternatively, the attacker compromises a legitimate website the user frequently visits and injects a malicious iframe or link pointing to an attacker-controlled HTTP endpoint that mimics the Maximo login page. When the user clicks the link or the browser auto-follows the request, the browser transmits the existing session cookie over the unencrypted HTTP connection. The attacker, positioned on the network or controlling a compromised ISP/WiFi access point, captures the plaintext cookie from the traffic and uses it to impersonate the user within Maximo, gaining unauthorized access to sensitive business asset data.