CVE-2026-15656: medium-severity vulnerability in IBM Maximo Application Suite
IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.2%
IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
IBM · Maximo Application SuiteRelated CVEs — IBM Maximo Application Suite
In the same product, most dangerous first.
CVE-2024-22328HIGHIBM Maximo Application Suite information disclosureEPSS 0.8%CVE-2023-32334LOWIBM Maximo Asset Management information disclosureEPSS 0.6%CVE-2023-32332MEDIUMIBM Maximo Application Suite and IBM Maximo Asset Management HTML injectionEPSS 0.6%CVE-2023-32335LOWIBM Maximo Application Suite information disclosureEPSS 0.5%CVE-2022-35645MEDIUMIBM Maximo Asset Management cross-site scriptingEPSS 0.5%CVE-2026-105052HIGHIBM Maximo Application Suite Information DisclosureEPSS 0.4%