SB2026081028 - Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
Published: August 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Uncontrolled Recursion (CVE-ID: CVE-2026-48712)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in google.protobuf.Any JSON conversion and generated toObject() conversion when converting decoded protobuf messages to JSON or plain objects. A remote attacker can provide a crafted protobuf binary payload with deeply nested Any values to cause a denial of service.
Exploitation requires that the application decode attacker-influenced protobuf input, that the schema include google.protobuf.Any with a resolvable type_url, and that the decoded message be converted through an affected JSON conversion path.
2) Uncontrolled Recursion (CVE-ID: CVE-2026-54269)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in protobufjs runtime helpers when processing schema-derived names that shadow runtime-significant properties. A remote attacker can provide a crafted protobuf schema or protobufjs JSON descriptor to cause a denial of service.
Exploitation requires the application to load or use a schema or descriptor containing a problematic name and to reach the affected API path.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-54270)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in unknown field retention during binary decode when processing attacker-controlled protobuf binary data. A remote attacker can send a crafted protobuf payload with many unknown fields to cause a denial of service.
Exploitation requires the application to decode untrusted protobuf binary input, treat attacker-selected field numbers as unknown, and retain decoded messages long enough for memory pressure to build.
4) Interpretation Conflict (CVE-ID: CVE-2026-13676)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify data on the system.
The vulnerability exists due to fast-uri fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. A remote attacker can trigger the vulnerability to modify data on the system.
5) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate arbitrary classes.
The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.
Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.
6) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to instantiate non-allowlisted types.
The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.
The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.
7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-54514)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause outbound DNS requests and disclose limited network information.
The vulnerability exists due to server-side request forgery in JDKFromStringDeserializer when deserializing untrusted JSON into a type containing an InetSocketAddress field. A remote attacker can supply a crafted hostname value to cause outbound DNS requests and disclose limited network information.
The DNS lookup occurs during readValue before application-level validation or explicit connection logic.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify otherwise ignored object attributes.
The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.
Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.
Remediation
Install update from vendor's website.