Medium · 5.3 CVE-2026-18531 EUVD-2026-53443GHSA-fjm9-fv2r-mxmv

IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

Published Aug 5, 2026 · Updated Aug 6, 2026 · Assigned by ibm

Vendor: IBM Product: Maximo Application Suite

Description

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret.

Affected products

Vendor	Product	Affected	Fixed
IBM	Maximo Application Suite	9.2, 9.1, 9.0	—

References

https://www.ibm.com/support/pages/node/7282362 vendor-advisory patch