IBM Maximo Application Suite EUVD-2026-53444

Exploitation requires that the victim is actively authenticated to IBM Maximo Application Suite 9.0, 9.1, or 9.2 at the time of the attack and is induced to initiate a plaintext HTTP request to the Maximo host - by clicking a crafted HTTP link delivered via phishing email, chat, or a malicious webpage containing an embedded HTTP resource. The attacker must control an HTTP-reachable endpoint (their own server) or be in a network position to intercept plaintext traffic (e.g., shared Wi-Fi, rogue access point, or man-in-the-middle). Exploitation is limited by the mandatory user interaction (UI:R): a fully passive attack without any victim action is not possible. The scope is further constrained to environments where MAS cookies are not protected by HSTS or where the browser has not yet cached HSTS policy for the domain. Versions outside 9.0-9.2 are not confirmed affected by the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) reflects a medium-severity finding: network-delivered, low-complexity, unauthenticated, but requiring user interaction with confidentiality impact limited to the cookie value itself. The practical risk is meaningfully higher than the score suggests - session token theft enables account takeover, which in an enterprise asset management context could allow an attacker to manipulate maintenance workflows, work orders, or operational data. The attack surface is bounded by the requirement for user interaction (UI:R) and, in some scenarios, a network-sniffing position, which elevates the real-world complexity beyond what AC:L implies in purely local network threat models. No EPSS data was provided, so statistical exploitation probability cannot be quantified. The absence of a KEV listing and any identified POC indicates this is not under active exploitation at time of analysis. Organizations running MAS in internet-exposed configurations or with a mobile/remote workforce using untrusted networks face materially elevated risk due to the prevalence of network interception opportunities.

An attacker registers an HTTP server at a convincing domain and sends a phishing email to known IBM MAS users containing an HTTP link constructed to reach the Maximo host or trigger a cross-origin request that causes the victim's browser to forward the session cookie. When the authenticated user clicks the link, the browser transmits the session cookie in the plaintext HTTP request, which the attacker's server logs directly - no network sniffing position required. The attacker then replays the captured cookie to the legitimate Maximo HTTPS endpoint, hijacking the user's authenticated session. No public POC has been identified; the attack relies entirely on standard browser cookie-handling behavior.