Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component uses pymongo-4.18.1 and is vulnerable to CVE-2026-96747, CVE-2026-96748, CVE-2026-96749

Summary IBM Maximo Application Suite - Location Service for Esri Component uses pymongo-4.18.1 and is vulnerable to CVE-2026-96747, CVE-2026-96748, CVE-2026-96749. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Details CVEID:CVE-2026-96747...

CVE-2026-18517

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy...

CVE-2026-18529

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...

CVE-2026-18533

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template...

CVE-2026-18513

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2026-18537

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template...

CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

EUVD-2026-97904

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2026-18513

The IBM Maximo Application Suite - Location Service for Esri Component versions 9.2 , 9.1 , and 9.0 are vulnerable to improper access control (CWE-269) due to a schema-less Custom Resource Definition . This flaw allows a CR author to redirect the arcgis-admin RoleBinding to their own ServiceAccou...

CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2026-18517 IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy...

CVE-2026-18517

The IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to unintended network egress in versions 9.2 , 9.1 , and 9.0 . This issue is caused by a misconfigured Kubernetes NetworkPolicy , which leads to Improper Access Control (CWE-284). The vulnerability allows for pot...

EUVD-2026-97903

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy...

CVE-2026-18517 IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy...

CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...

EUVD-2026-97902

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...

CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...

CVE-2026-18529

The IBM Maximo Application Suite - Location Service for Esri Component versions 9.2 , 9.1 , and 9.0 are vulnerable to command injection (CWE-78). This is caused by the improper sanitisation of a user-controlled value passed to a shell command within a Kubernetes operator task . An attacker could ...

CVE-2026-18533 IBM Maximo Application Suite - Location Service for Esri Component Code Execution

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template...

EUVD-2026-97901

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template...