CVE-2026-18531

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret.

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS probability

0.23%

CWE

CWE-330

Published

2026-08-05

Last modified

2026-08-06

Affected products

• IBM Maximo Application Suite
• IBM Maximo Application Suite
• IBM Maximo Application Suite

Weakness type

• CWE-330

Related vulnerabilities

• CVE-2026-53939 — OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
• CVE-2026-86187 — WWBN AVideo Weak PRNG Password Generation via External Login
• CVE-2026-17274 — IBM i is Affected By Multiple Vulnerabilities in Debug Server
• CVE-2026-3416 — Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads
• CVE-2026-66047 — ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE
• CVE-2026-81852 — AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
• CVE-2026-82555 — TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values
• CVE-2026-19485 — Bucket Squatting in Vertex AI Search for Commerce

Markdown version · Browse all CVEs