External risk intelligence

IBM Maximo Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-36386

IBM Maximo Application Suite is an enterprise asset management platform frequently deployed as a public-facing or externally accessible web application to support remote access, vendor portals, and mobile workforce connectivity, making its authentication interfaces a common target for internet-based interaction.

Ibm Maximo Application Suite

9.0 to 9.0.159.1.0 to 9.1.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in IBM Maximo Application Suite that could allow unauthorized remote access to the system by bypassing authentication. This issue affects specific versions of the software, and its exposure as an external threat warrants attention.

Unauthenticated remote access bypassing security.
Critical vulnerability in asset management software.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to an exposed IBM Maximo Application Suite instance. Successful exploitation could allow the attacker to bypass authentication and gain unauthorized access, potentially leading to sensitive data exposure, modification, or system disruption.

No authentication is required.
Exploited via network requests.
Enables unauthorized system access.

Live Threat

Current exploitation, exposure, and threat context

IBM Maximo Application Suite, when accessible remotely, could allow an unauthenticated attacker to bypass normal login procedures. This could potentially grant them unauthorized access to the application's functionalities and data.

Unauthorized access to application features.
Bypassing authentication controls remotely.
Exposure of application data and functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

IBM Maximo Application Suite, an enterprise asset management platform often deployed for remote access, may be vulnerable to a critical authentication bypass. Owners of this application, potentially within infrastructure, platform, or security teams, must first identify all instances of the affected product, confirm their exposure and business criticality, and then assign an accountable owner to plan remediation.

Application and platform teams own remediation.
Verify all Maximo Application Suite instances.
Plan coordinated updates and testing.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Maximo Application Suite?

It is an enterprise asset management platform used by organizations to track, maintain, and optimize physical infrastructure and equipment. It integrates tools for managing the lifecycle of complex assets, often serving as a central hub that connects field technicians, facility managers, and vendor portals through a unified web-based interface.

How does the CVE-2025-36386 authentication bypass work?

This vulnerability, classified as CWE-305 (Authentication Bypass), represents a failure in the software's identity verification logic. Essentially, the application contains a flaw that allows a remote user to access protected features without providing valid credentials. Because the system fails to correctly validate the requester's identity, the attacker can interact with the suite as if they were a logged-in user.

Does this vulnerability require special user actions?

No. A key characteristic of this flaw is that it does not require an attacker to have a pre-existing account or perform any specific interaction, such as clicking a link. The vulnerability is triggered by sending specially crafted network requests directly to the application. If the request is formatted to exploit the bypass, the system accepts it without requiring authentication.

How relevant is this threat to my environment?

According to Halo Surface Signal, this vulnerability is highly relevant because IBM Maximo Application Suite is frequently deployed as a public-facing web application. Since it often supports remote mobile workforces and vendor portals, instances are commonly exposed to the internet. If your instance is reachable from the public web, it is a primary candidate for this type of network-based attack.

What should I do first to address this?

Begin by identifying every instance of IBM Maximo Application Suite running within your network, regardless of whether it is managed by IT, infrastructure, or specialized business teams. Once you have a complete inventory, verify which instances are accessible externally. Coordinate with your technical owners to prioritize these high-risk, internet-facing assets for remediation planning.

References

www.ibm.com/support/pages/node/7249416

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.