SB2026060221 - Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026060221

SB2026060221 - Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component

Published: June 2, 2026

Security Bulletin ID SB2026060221
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Prototype pollution (CVE-ID: CVE-2026-41238)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.

The vulnerability exists due to improperly controlled modification of object prototype attributes in DOMPurify sanitize configuration handling when sanitizing user-supplied HTML with the default CUSTOM_ELEMENT_HANDLING behavior. A remote attacker can supply crafted HTML and leverage prior prototype pollution to execute arbitrary script in a victim's browser.

User interaction is required, and exploitation requires a prototype pollution primitive in the same execution context.


2) Cross-site scripting (CVE-ID: CVE-2026-41239)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper neutralization of script-related template expressions in SAFE_FOR_TEMPLATES mode in the DOMPurify sanitizer when sanitizing crafted HTML and returning a DOM node with RETURN_DOM enabled. A remote attacker can supply specially crafted markup to execute arbitrary script in the victim's browser.

Exploitation requires the application to append the returned DOM to the document and process it with a client-side framework.


3) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-41240)

CWE-ID: CWE-183 - Permissive List of Allowed Inputs

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to inject forbidden elements into sanitized output.

The vulnerability exists due to a permissive list of allowed inputs in tag filtering logic when sanitizing content with a function-based ADD_TAGS predicate and FORBID_TAGS configured. A remote user can supply crafted markup that uses forbidden tags to inject forbidden elements into sanitized output.

Only configurations that use a function-based ADD_TAGS predicate are vulnerable.


Remediation

Install update from vendor's website.

References