Maximo Application Suite Security Bulletins October 2026

IBM has released Maximo Application Suite Security Bulletins. The links to the bulletins are below. The bulletins contain information regarding when, where, and/or how to address the vulnerability.

Security bulletin: Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7282384?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7282383?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses go.mongodb.org/mongo-driver-v1.12.0 which is vulnerable to CVE-2026-2303 –

https://www.ibm.com/support/pages/node/7282486?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/sys-v0.38.0 which is vulnerable to CVE-2026-39824 –

https://www.ibm.com/support/pages/node/7282485?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar which is vulnerable to CVE-2026-53655 –

https://www.ibm.com/support/pages/node/7282484?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses postcss-selector-parser-7.1.1.tgz which is vulnerable to CVE-2026-9358 –

https://www.ibm.com/support/pages/node/7282483?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to CVE-2026-2332 –

https://www.ibm.com/support/pages/node/7282489?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-5241 –

https://www.ibm.com/support/pages/node/7282516?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses langchain_core-0.3.86-py3-none-any.whl which is vulnerable to CVE-2026-34070 –

https://www.ibm.com/support/pages/node/7282626?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: There is a vulnerability in netty-resolver-dns-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-45673, CVE-2026-45674, CVE-2026-47691) –

https://www.ibm.com/support/pages/node/7282713?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses httpcore5-5.3.4.jar which is vulnerable to CVE-2026-54399 –

https://www.ibm.com/support/pages/node/7282763?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428 –

https://www.ibm.com/support/pages/node/7282764?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: There is a vulnerability in freemarker-2.3.22.jar used by IBM Maximo Manage application in IBM Maximo Application Suite –

https://www.ibm.com/support/pages/node/7282903?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses js-yaml which is vulnerable to CVE-2025-64718, CVE-2026-53550, CVE-2026-59869 –

https://www.ibm.com/support/pages/node/7283106?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses js-yaml-4.1.1.tgz which is vulnerable to CVE-2026-53550 –

https://www.ibm.com/support/pages/node/7283481?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uuid-9.0.1.tgz which is vulnerable to CVE-2026-41988 –

https://www.ibm.com/support/pages/node/7283491?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite runtime-7.28.4.tgz which is vulnerable to CVE-2025-27789 –

https://www.ibm.com/support/pages/node/7283490?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses adm-zip-0.5.16.tgz which is vulnerable to CVE-2026-39244 –

https://www.ibm.com/support/pages/node/7285428?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to CVE-2026-14257 –

https://www.ibm.com/support/pages/node/7285432?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses postcss-8.4.38.tgz package which is vulnerable to CVE-2026-45623 –

https://www.ibm.com/support/pages/node/7285441?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285433?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Edge Data Collector uses cmov-0.5.3.crate which is vulnerable to CVE-2026-50185 –

https://www.ibm.com/support/pages/node/7285431?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285430?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285440?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285438?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses ws-7.5.11.tgz which is vulnerable to CVE-2026-62389 –

https://www.ibm.com/support/pages/node/7285439?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses cryptography which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285436?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses dompurify-3.4.8.tgz which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285435?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses kafka_python-2.3.0-py2.py3-none-any.wh which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285442?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Monitor Component uses js-yaml-4.1.1.tgz which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285443?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite –

https://www.ibm.com/support/pages/node/7285506?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153) –

https://www.ibm.com/support/pages/node/7285505?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite –

https://www.ibm.com/support/pages/node/7285504?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite –

https://www.ibm.com/support/pages/node/7285508?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-11806, CVE-2026-11541) –

https://www.ibm.com/support/pages/node/7285513?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component uses pyasn1-0.6.3 which is vulnerable to CVE-2026-59884, CVE-2026-59885, CVE-2026-59886 –

https://www.ibm.com/support/pages/node/7285541?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses ansible_core-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010 –

https://www.ibm.com/support/pages/node/7285543?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty v.26.0.0.6 which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285718?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285722?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7285721?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses nanoid-3.3.11.tgz which is vulnerable to CVE-2026-67213, CVE-2026-67214 –

https://www.ibm.com/support/pages/node/7285783?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses dompurify-3.4.7.tgz which is vulnerable to CVE-2026-65898, CVE-2026-65899, CVE-2026-65900 –

https://www.ibm.com/support/pages/node/7285781?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses postcss-8.5.10.tgz which is vulnerable to CVE-2026-45623 –

https://www.ibm.com/support/pages/node/7285898?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: IBM Edge Data Collector component uses multiple dependencies which are vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7286064?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7286214?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7286213?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697 –

https://www.ibm.com/support/pages/node/7286489?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs –

https://www.ibm.com/support/pages/node/7286586?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: Security Vulnerability identified in neethi-3.2.2.jar used by IBM Maximo Application Suite - MREF ( CVE-2026-66142, CVE-2026-66143, CVE-2026-66144 ) –

https://www.ibm.com/support/pages/node/7287123?myns=swgother&mynp=OCSSZBD7&mync=E&cm_sp=swgother-_-OCSSZBD7-_-E

Security bulletin: Security Bulletin: Security Vulnerability identified in libthrift-0.23.0.jar used by IBM Maximo Application Suite - MREF ( CVE-2026-43871, CVE-2026-45112, CVE-2026-48586 ) –

https://www.ibm.com/support/pages/node/7287189?myns=swgother&mynp=OCSSZBD7&mync=E&cm_sp=swgother-_-OCSSZBD7-_-E

Security bulletin: Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite –

https://www.ibm.com/support/pages/node/7287303?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite –

https://www.ibm.com/support/pages/node/7287302?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Flashes: IBM Semeru Runtime includes restricted security profiles used by Maximo Application Suite components operating in FIPS 140-2 mode. The applicable Semeru FIPS 140-2 restricted security profile reaches its sunset date on 21 September 2026 –

https://www.ibm.com/support/pages/node/7287343?myns=swgother&mynp=OCSSRHPA&mynp=OCSSO1W7&mync=E&cm_sp=swgother-_-OCSSRHPA-OCSSO1W7-_-E

Security bulletin: Security Bulletin: IBM Maximo Application Suite uses httpclient5-5.6.3.jar which is vulnerable to CVE-2026-71290 –

https://www.ibm.com/support/pages/node/7287328?myns=swgother&mynp=OCSSJ5IPE&mync=E&cm_sp=swgother-_-OCSSJ5IPE-_-E

Security bulletin: Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite –

https://www.ibm.com/support/pages/node/7287720?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294 –

https://www.ibm.com/support/pages/node/7287766?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management –

https://www.ibm.com/support/pages/node/7287904?myns=swgother&mynp=OCSSLKT6&mynp=OCSSG2D3&mynp=OCSSKVFR&mynp=OCSSLL9Z&mynp=OCSSWT9A&mynp=OCSSLL84&mynp=OCSSLL9G&mynp=OCSSLL8M&mynp=OCSSLLAM&mynp=OCSS5RRF&mynp=OCSSLKSJ&mync=E&cm_sp=swgother-_-OCSSLKT6-OCSSG2D3-OCSSKVFR-OCSSLL9Z-OCSSWT9A-OCSSLL84-OCSSLL9G-OCSSLL8M-OCSSLLAM-OCSS5RRF-OCSSLKSJ-_-E

Security bulletin: Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-25526) –

https://www.ibm.com/support/pages/node/7287905?myns=swgother&mynp=OCSSRHPA&mync=E&cm_sp=swgother-_-OCSSRHPA-_-E

Security bulletin: Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application –

https://www.ibm.com/support/pages/node/7287903?myns=swgother&mynp=OCSSLKT6&mync=E&cm_sp=swgother-_-OCSSLKT6-_-E

Flashes: IBM Semeru Runtime includes restricted security profiles used by Maximo Application Suite components operating in FIPS 140-2 mode. The applicable Semeru FIPS 140-2 restricted security profile reaches its sunset date on 21 September 2026 –

https://www.ibm.com/support/pages/node/7287343?myns=swgother&mynp=OCSSRHPA&mynp=OCSSO1W7&mync=E&cm_sp=swgother-_-OCSSRHPA-OCSSO1W7-_-E

Security bulletin: Security Bulletin: Security Vulnerability identified in jsoup used by IBM Maximo Application Suite - MREF ( CVE-2026-75140 ) –

https://www.ibm.com/support/pages/node/7288841?myns=swgother&mynp=OCSSZBD7&mync=E&cm_sp=swgother-_-OCSSZBD7-_-E

Security updates are only one part of protecting your Maximo environment. If you're planning an upgrade, evaluating your current version, or need guidance on applying the latest security recommendations, Interloc Solutions can help. Our team has extensive experience helping organizations modernize their Maximo environments with minimal disruption, reduced risk, and a clear path forward.

Contact us today to discuss your upgrade strategy and ensure your environment remains secure, supported, and ready for the future.