SB2026011302 - Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
Published: January 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2025-8916)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Security and Provisioning (Bouncy Castle Java Library) component in Oracle Essbase. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
2) Input validation error (CVE-ID: CVE-2025-22872)
The vulnerability allows a remote attacker to perform code injection attacks.
The vulnerability exists due to insufficient validation of tags with unquoted attribute values that end with a solidus character (/). The tokenizer can interpret such tags as self-closing, leading to content following such tags as being placed in the wrong scope during DOM construction.
3) Improper input validation (CVE-ID: CVE-2025-21502)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
4) Missing initialization of resource (CVE-ID: CVE-2025-54410)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to Docker fails to re-create iptables rules that isolate bridge networks when firewalld reloads, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. A local user can gain unauthorized access to sensitive information on the system.
5) Memory leak (CVE-ID: CVE-2025-58058)
The vulnerability allows a remote attacker to perform a DoS attack.
The vulnerability exists due memory leak when decoding corrupted LZMA archives. A remote attacker can force the application to leak memory and perform denial of service attack.
6) Input validation error (CVE-ID: CVE-2025-22870)
The vulnerability allows a remote attacker to alter application's behavior.
The vulnerability exists due to insufficient validation of an IPv6 zone ID as a hostname component, when matching hosts against proxy patterns. For instance the NO_PROXY environment variable is set to "*.example.com", a request to
"[::1%25.example.com]:80` will incorrectly match and not be proxied. A remote attacker can alter application behavior and potentially gain access to sensitive information or functionality.
Remediation
Install update from vendor's website.