SB2026101605 - Multiple vulnerabilities in IBM Maximo Application Suite - MREF
Published: October 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Path traversal (CVE-ID: CVE-2026-47884)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper path limitation in XsltView when rendering views through a catch-all "/**" mapping without an explicitly specified view name. A remote attacker can send a specially crafted request to execute arbitrary code.
The issue can also lead to server-side request forgery.
2) Open redirect (CVE-ID: CVE-2026-47887)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect users to an arbitrary URL.
The vulnerability exists due to an open redirect in UrlFileNameViewController when processing requests in applications where it is mapped with an end-of-path and no prefix is configured. A remote attacker can send a specially crafted request to redirect users to an arbitrary URL.
3) CRLF injection (CVE-ID: CVE-2026-47890)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to corrupt the stream of data sent to other users.
The vulnerability exists due to improper neutralization of carriage return line feeds in server-sent event view fragment rendering when streaming attacker-controlled data to clients over server-sent events. A remote user can control data that is streamed to other users to corrupt the stream of data sent to other users.
Exploitation requires the application to use Spring MVC or Spring WebFlux and send view fragments to clients over server-sent events.
4) CRLF injection (CVE-ID: CVE-2026-59313)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to corrupt the stream of data sent to other users.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.
User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.
Remediation
Install update from vendor's website.