SB2026080425 - Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080425

SB2026080425 - Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component

Published: August 4, 2026

Security Bulletin ID SB2026080425
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2025-11143)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to a differential parsing of URIs between different components of the application. A remote attacker can use such behavior to bypass implemented security restrictions. 


2) Incorrect authorization (CVE-ID: CVE-2026-59889)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in UnwrappedPropertyHandler.processUnwrapped() when deserializing @JsonUnwrapped container properties under a less-privileged active view. A remote user can supply crafted JSON values for a property annotated with both @JsonView and @JsonUnwrapped to escalate privileges.

This affects the write-side authorization behavior of @JsonView during deserialization, including merge and builder-based deserialization paths.


3) Algorithm Downgrade (CVE-ID: CVE-2026-54291)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass channel-binding protection and enable a man-in-the-middle downgrade of authentication.

The vulnerability exists due to failing open and algorithm downgrade in ScramAuthenticator when processing certificates whose signature algorithm has no tls-server-end-point channel-binding hash. A remote attacker can present a certificate with an unsupported signature algorithm while intercepting the TLS connection to bypass channel-binding protection and enable a man-in-the-middle downgrade of authentication.

Only connections configured with channelBinding=require are affected.


4) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-33558)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.


Remediation

Install update from vendor's website.

References