{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:22:16.531798Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:48:38.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*"
          ],
          "product": "Maximo Application Suite",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "8.10"
            },
            {
              "status": "affected",
              "version": "8.11"
            },
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.1"
            },
            {
              "status": "affected",
              "version": "9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.\u003c/p\u003e"
            }
          ],
          "value": "IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T21:05:04.599Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7290791"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA fix has been released for all supported MAS versions and will also be included in the next \u003ca href=\"https://www.ibm.com/support/pages/node/6570601\" rel=\"nofollow\"\u003emonthly update\u003c/a\u003e. We strongly recommend applying this fix immediately rather than waiting for the monthly update.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eRemediated Product(s)\u003c/td\u003e\u003ctd\u003eMas Verision(s)\u003c/td\u003e\u003ctd\u003eCoreIdp Version(s)\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.10.37\u003c/td\u003e\u003ctd\u003e3.2.201\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.11.34\u003c/td\u003e\u003ctd\u003e4.0.179\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.0.32\u003c/td\u003e\u003ctd\u003e5.1.148\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.1.26\u003c/td\u003e\u003ctd\u003e6.3.60\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.2.7\u003c/td\u003e\u003ctd\u003e8.1.36\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e"
            }
          ],
          "value": "A fix has been released for all supported MAS versions and will also be included in the next  monthly update https://www.ibm.com/support/pages/node/6570601 . We strongly recommend applying this fix immediately rather than waiting for the monthly update.\n\nRemediated Product(s)Mas Verision(s)CoreIdp Version(s)IBM Maximo Application Suite8.10.373.2.201IBM Maximo Application Suite8.11.344.0.179IBM Maximo Application Suite9.0.325.1.148IBM Maximo Application Suite9.1.266.3.60IBM Maximo Application Suite9.2.78.1.36"
        }
      ],
      "title": "IBM Maximo Application Suite Information Disclosure",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHow To Apply the Fix\u003c/p\u003e\u003col\u003e\u003cli\u003eOpen the OpenShift console and navigate to \u003cstrong\u003eAdministration \u0026gt; CustomResourceDefinitions\u003c/strong\u003e.\u00a0\u003c/li\u003e\u003cli\u003eSearch for \u003cstrong\u003ecoreidp.\u003c/strong\u003e\u003c/li\u003e\u003cli\u003eShow coreidp instances.\u003c/li\u003e\u003cli\u003eSelect the instance associated with your MAS installation;\u003c/li\u003e\u003cli\u003eEdit Coreidp CR for your instance with the following under spec.settings field:\u003c/li\u003e\u003cli\u003eUnder the \u003ccode\u003espec.settings\u003c/code\u003e field, add the following configuration, replacing \u003ccode\u003e\u0026lt;version\u0026gt;\u003c/code\u003e with the value specified in the table above for your MAS release:\u003cbr/\u003e\u003cpre\u003e\u003ccode\u003espec:\n  settings:\n    imageTags:\n      coreidplogin: \u0026lt;version\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eSave the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\u003c/li\u003e\u003cli\u003eWait for the new deployment to become ready, then follow the validation steps below.\u00a0\u003cbr/\u003e\u003cstrong\u003e\u003cbr/\u003eIMPORTANT\u003c/strong\u003e: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.\u003cbr/\u003e\u003cbr/\u003e\u003cp\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e"
            }
          ],
          "value": "How To Apply the Fix\n\n  *  Open the OpenShift console and navigate to Administration \u003e CustomResourceDefinitions.\u00a0\n  *  Search for coreidp.\n  *  Show coreidp instances.\n  *  Select the instance associated with your MAS installation;\n  *  Edit Coreidp CR for your instance with the following under spec.settings field:\n  *  Under the spec.settings field, add the following configuration, replacing \u003cversion\u003e with the value specified in the table above for your MAS release:\n\n\nspec:\n  settings:\n    imageTags:\n      coreidplogin: \u003cversion\u003e\n\n\n  *  Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\n  *  Wait for the new deployment to become ready, then follow the validation steps below.\u00a0\n\nIMPORTANT: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-105052",
    "datePublished": "2026-10-12T21:01:02.786Z",
    "dateReserved": "2026-10-02T23:51:23.455Z",
    "dateUpdated": "2026-10-13T13:48:38.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-105052\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-13T13:22:16.531798Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-13T13:48:16.184Z\"}}], \"cna\": {\"title\": \"IBM Maximo Application Suite Information Disclosure\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"Maximo Application Suite\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.10\"}, {\"status\": \"affected\", \"version\": \"8.11\"}, {\"status\": \"affected\", \"version\": \"9.0\"}, {\"status\": \"affected\", \"version\": \"9.1\"}, {\"status\": \"affected\", \"version\": \"9.2\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"A fix has been released for all supported MAS versions and will also be included in the next  monthly update https://www.ibm.com/support/pages/node/6570601 . We strongly recommend applying this fix immediately rather than waiting for the monthly update.\\n\\nRemediated Product(s)Mas Verision(s)CoreIdp Version(s)IBM Maximo Application Suite8.10.373.2.201IBM Maximo Application Suite8.11.344.0.179IBM Maximo Application Suite9.0.325.1.148IBM Maximo Application Suite9.1.266.3.60IBM Maximo Application Suite9.2.78.1.36\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA fix has been released for all supported MAS versions and will also be included in the next \u003ca href=\\\"https://www.ibm.com/support/pages/node/6570601\\\" rel=\\\"nofollow\\\"\u003emonthly update\u003c/a\u003e. We strongly recommend applying this fix immediately rather than waiting for the monthly update.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eRemediated Product(s)\u003c/td\u003e\u003ctd\u003eMas Verision(s)\u003c/td\u003e\u003ctd\u003eCoreIdp Version(s)\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.10.37\u003c/td\u003e\u003ctd\u003e3.2.201\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.11.34\u003c/td\u003e\u003ctd\u003e4.0.179\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.0.32\u003c/td\u003e\u003ctd\u003e5.1.148\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.1.26\u003c/td\u003e\u003ctd\u003e6.3.60\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.2.7\u003c/td\u003e\u003ctd\u003e8.1.36\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7290791\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"How To Apply the Fix\\n\\n  *  Open the OpenShift console and navigate to Administration \u003e CustomResourceDefinitions.\\u00a0\\n  *  Search for coreidp.\\n  *  Show coreidp instances.\\n  *  Select the instance associated with your MAS installation;\\n  *  Edit Coreidp CR for your instance with the following under spec.settings field:\\n  *  Under the spec.settings field, add the following configuration, replacing \u003cversion\u003e with the value specified in the table above for your MAS release:\\n\\n\\nspec:\\n  settings:\\n    imageTags:\\n      coreidplogin: \u003cversion\u003e\\n\\n\\n  *  Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\\n  *  Wait for the new deployment to become ready, then follow the validation steps below.\\u00a0\\n\\nIMPORTANT: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eHow To Apply the Fix\u003c/p\u003e\u003col\u003e\u003cli\u003eOpen the OpenShift console and navigate to \u003cstrong\u003eAdministration \u0026gt; CustomResourceDefinitions\u003c/strong\u003e.\\u00a0\u003c/li\u003e\u003cli\u003eSearch for \u003cstrong\u003ecoreidp.\u003c/strong\u003e\u003c/li\u003e\u003cli\u003eShow coreidp instances.\u003c/li\u003e\u003cli\u003eSelect the instance associated with your MAS installation;\u003c/li\u003e\u003cli\u003eEdit Coreidp CR for your instance with the following under spec.settings field:\u003c/li\u003e\u003cli\u003eUnder the \u003ccode\u003espec.settings\u003c/code\u003e field, add the following configuration, replacing \u003ccode\u003e\u0026lt;version\u0026gt;\u003c/code\u003e with the value specified in the table above for your MAS release:\u003cbr/\u003e\u003cpre\u003e\u003ccode\u003espec:\\n  settings:\\n    imageTags:\\n      coreidplogin: \u0026lt;version\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eSave the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\u003c/li\u003e\u003cli\u003eWait for the new deployment to become ready, then follow the validation steps below.\\u00a0\u003cbr/\u003e\u003cstrong\u003e\u003cbr/\u003eIMPORTANT\u003c/strong\u003e: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.\u003cbr/\u003e\u003cbr/\u003e\u003cp\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \\\"dot dot\\\" sequences (/../) to view arbitrary files on the system.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \\\"dot dot\\\" sequences (/../) to view arbitrary files on the system.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-10-12T21:05:04.599Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-105052\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-13T13:48:38.703Z\", \"dateReserved\": \"2026-10-02T23:51:23.455Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-10-12T21:01:02.786Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}