{"id":"CVE-2025-36386","state":"PUBLISHED","title":"There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics","description":"IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.","publishedAt":"2025-10-28T15:56:58.740Z","updatedAt":"2025-10-28T16:57:09.538Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"ibm"},"assigner":"ibm","products":["IBM IBM Maximo Application Suite"],"affected":[{"vendor":"IBM","product":"IBM Maximo Application Suite","defaultStatus":"unaffected","versions":[{"version":"9.0.0","status":"affected","lessThanOrEqual":"9.0.15","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThanOrEqual":"9.1.4","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.0.15:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.4:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7249416"],"weaknesses":["CWE-305"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/36xxx/CVE-2025-36386.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-36386","state":"PUBLISHED","datePublished":"2025-10-28T15:56:58.740Z","dateUpdated":"2025-10-28T16:57:09.538Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2025-04-15T21:16:57.301Z"},"containers":{"cna":{"title":"There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics","descriptions":[{"lang":"en","value":"IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application."}],"affected":[{"vendor":"IBM","product":"IBM Maximo Application Suite","defaultStatus":"unaffected","versions":[{"version":"9.0.0","status":"affected","lessThanOrEqual":"9.0.15","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThanOrEqual":"9.1.4","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.0.15:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.4:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7249416","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-305","description":"CWE-305 Authentication Bypass by Primary Weakness","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2025-10-28T15:58:50.265Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"9.0.15","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"9.1.4","versionStartIncluding":"9.1.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central</p>"}],"value":"Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central"}],"x_generator":{"engine":"ibm-cvegen"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-28T16:54:30.318336Z","id":"CVE-2025-36386","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-28T16:57:09.538Z"}}]}}}