EUVD-2026-97971
GHSA-86gx-4rgr-jwmv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IoT Component over network
-
DeliverySend crafted recursive input
-
ExploitTrigger uncontrolled recursion (CWE-674)
-
ExecutionExhaust stack/CPU resources
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires network reachability to the IBM Maximo Application Suite IoT Component (versions 9.0.0, 9.1.0, or 9.2.0) and the ability to submit input to its parsing/processing logic; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, special privileges, or user interaction is needed against an exposed instance. The main limiting factor is network exposure: if the IoT Component's listening interface is segmented, firewalled, or not reachable by untrusted actors, the practical attack surface shrinks substantially. Impact is limited to denial of service (A:H only) with no confidentiality or integrity effect. |
| Impact | This is a network-reachable, unauthenticated availability-only flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) caused by uncontrolled recursion (CWE-674) in the IBM Maximo Application Suite IoT Component. The CVSS vector is internally consistent with the description: a remote attacker can send crafted input that triggers unbounded recursion, exhausting stack or CPU and causing denial of service, with no impact to confidentiality or integrity. No EPSS score was supplied in the input, and the CVE is NOT in CISA KEV and has no public POC referenced, so despite the elevated CVSS this presents as a high-severity-but-low-demonstrated-real-risk issue at the time of analysis - exploitation is plausible given the low attack complexity and no privilege/interaction requirement, but there is no evidence of active exploitation or weaponization. The practical risk is bounded to availability: this is a service-disruption bug, not a code-execution or data-exposure one. A vendor patch is available, which makes remediation straightforward and lowers residual risk. Priority should be driven by how exposed the IoT Component's network interface is and how critical uptime is for the deployment, rather than by the raw score alone. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Maximo Application Suite IoT Component over the network sends specially crafted input that triggers deeply nested or self-referential processing, driving uncontrolled recursion. The resulting stack exhaustion or CPU saturation crashes or hangs the component, denying service to legitimate IoT data flows. No public exploit code has been identified, but the low attack complexity (AC:L) with no authentication or user interaction makes reliable triggering feasible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Denial of service in the IBM Maximo Application Suite IoT Component (versions 9.0.0, 9.1.0, and 9.2.0) allows a remote, unauthenticated attacker to exhaust or crash the service by triggering uncontrolled recursion in its input parsing/processing logic. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials or user interaction are required against a network-reachable instance, but the impact is strictly availability - there is no confidentiality or integrity effect. At the time of analysis there is no public exploit identified, and the vendor has released a fix via its support portal.
RemediationAI
Apply the vendor-supplied fix; IBM reports a patch as available and it is distributed through the advisory at https://www.ibm.com/support/pages/node/7290173 - follow IBM's guidance for the exact fixed release applicable to the 9.0.0, 9.1.0, or 9.2.0 line you run, since the input does not name a specific patched version. Until the update is deployed, reduce exposure by placing the IoT Component behind network segmentation so its listening interfaces are not reachable from untrusted networks, which directly removes the only precondition in the CVSS vector (AV:N) and is the highest-value compensating control; if the component must remain internet- or partner-facing, front it with a reverse proxy or WAF and rate-limit and cap request body sizes to blunt recursive payloads, accepting that such filtering may break legitimate large or deeply nested device messages. Apply process/container memory and restart limits so a crash is contained and the service recovers automatically, though this treats the symptom rather than the recursion defect. Routinely review Maximo Application Suite security bulletins for the fixed release identifier before closing the finding.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is IBM's Maximo Application Suite IoT module, which handles telemetry, device messaging, and structured input ingestion for asset-management deployments. The root cause is CWE-674 (Uncontrolled Recursion): the software recursively processes nested or self-referential input without a sufficient depth limit or base-case guard, so a crafted payload drives the call stack deep enough to exhaust stack memory and terminate or wedge the process. Because the failure is in the parser/processing layer rather than in authentication or authorization, it is reached over the network with no privileges (PR:N) and no user interaction (UI:N). The CPE entry cpe:2.3:a:ibm:maximo_application_suite_-_iot_component:*:*:*:*:*:*:*:* confirms the IoT Component as the sole affected product family, spanning the 9.0.0, 9.1.0, and 9.2.0 release lines.
Know when Maximo Application Suite Iot Component gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated input triggers recursion with no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS (C:N/I:N/A:H), scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
Executive ViewAI
IBM Maximo Application Suite IoT Component versions 9.0.0, 9.1.0, and 9.2.0 are affected by a high-severity denial-of-service vulnerability that can be triggered remotely without authentication, potentially disrupting availability of IoT data processing and asset management workflows. While there is no public exploit identified at time of analysis, the flaw requires immediate attention because a successful attack could halt critical operational visibility for organizations relying on this platform. Leadership should prioritize patching and assess exposure of internet-facing instances to mitigate operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB