Maximo Application Suite EUVD-2026-97902

Exploitation requires that the IBM Maximo Application Suite 'Location Service for Esri' component (version 9.0, 9.1, or 9.2) is deployed and enabled, and that the attacker holds HIGH privileges (PR:H) sufficient to supply the user-controlled value that is passed into the shell command executed by the Kubernetes operator task. The limiting factors are therefore: (1) presence of this specific optional Esri location component, and (2) pre-existing privileged/authenticated access to the MAS environment - there is no user-interaction requirement (UI:N) and low attack complexity (AC:L), so once those two conditions hold, injection is straightforward.

This is a legitimately serious but access-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) signals a network-reachable, low-complexity flaw that nonetheless requires HIGH privileges (PR:H), meaning the attacker must already hold a privileged/authenticated role before they can inject commands into the Kubernetes operator task. The scope-change flag (S:C) is the aggravating factor: command injection in a Kubernetes operator typically executes with elevated cluster-level privileges, so a successful attack can impact resources beyond the vulnerable component itself - which is why the 8.7 score is high despite PR:H. Signals are thin and partly conflicting: no EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note also that the vendor set A:N (no availability impact), which is unusual for a CWE-78 OS command injection where arbitrary command execution would normally permit disruption - this A:N should be verified against the IBM advisory. Net: treat as a real patch priority for organizations actually running the Esri Location Service component, but the PR:H precondition and absence of any exploitation signal place it below internet-facing unauthenticated criticals in triage order.

A privileged user or an attacker who has already compromised a high-privilege MAS account supplies a crafted value containing shell metacharacters that is passed unsanitised into a shell command within a Kubernetes operator task. When the operator processes the task, the injected command executes in the operator's context, allowing the attacker to run arbitrary OS commands and, because the operator holds elevated cluster privileges, pivot beyond the Location Service component. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means exploitation is reliable once the privileged access precondition is met.