Maximo Application Suite EUVD-2026-97900

Exploitation requires the attacker to control or influence the container image reference consumed by the Location Service for Esri Kubernetes operator template - i.e., privileged access sufficient to modify the operator's input (custom resource/template values), consistent with PR:H in the CVSS vector. Limiting factors: this is not reachable by an unauthenticated outsider against a default deployment; the attacker needs existing high-privilege access to the Kubernetes/Maximo operator configuration, no user interaction is required (UI:N), and only affected versions 9.0, 9.1, and 9.2 of the Location Service for Esri component are in scope. The scope change (S:C) means a successful injection can impact workloads beyond the operator's own authority.

This is a CWE-94 code injection flaw (CVSS 8.7, High) in the IBM Maximo Application Suite Location Service for Esri component, where an unsanitised container image reference in a Kubernetes operator template allows injection. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N indicates network reachability with low complexity but requires HIGH privileges (PR:H) - meaning the attacker must already have elevated access to influence the operator template/configuration, which substantially narrows the realistic attacker population to insiders or those who have already compromised a privileged account. The scope change (S:C) justifies the elevated score because a compromised operator can affect other workloads in the cluster beyond its own security authority. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no public exploit identified at time of analysis; the high base score is driven by impact and scope, not by demonstrated real-world exploitation. Net assessment: a genuine high-impact vulnerability where it applies, but the PR:H prerequisite and the absence of any exploitation signal (EPSS/KEV/POC) place it below the urgency of a widely-exploited unauthenticated RCE - prioritise patching for exposed Maximo clusters but it is not an emergency-tier internet-wide threat.

An attacker who already holds privileged access to the Kubernetes environment running Maximo (e.g., ability to modify the operator's custom resource or template inputs) supplies a crafted container image reference containing injected content that the operator template does not sanitise. When the operator reconciles, the injected reference is processed, leading to code injection and compromise that, per the scope-changed CVSS, can affect other components in the cluster. No public exploit code was provided in the input, and successful exploitation hinges on the attacker's existing high-privilege access (PR:H).