How severe is CVE-2026-4820?

CVE-2026-4820 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-4820 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-4820?

CVE-2026-4820 affects Ibm Maximo Application Suite. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-4820?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-4820 have an EU (EUVD) identifier?

Yes. CVE-2026-4820 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18068.

When was CVE-2026-4820 published?

CVE-2026-4820 was published on 2026-04-01 and last updated on 2026-06-17.

CVE-2026-4820

CVE-2026-4820 is a medium-severity vulnerability in Ibm Maximo Application Suite with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-319.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (2nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-18068
Weakness: CWE-319
Affected product: Ibm Maximo Application Suite
Published: 2026-04-01
Last modified: 2026-06-17

Description

IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

Frequently asked questions

What is CVE-2026-4820?: IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
How severe is CVE-2026-4820?: CVE-2026-4820 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-4820 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-4820?: CVE-2026-4820 affects Ibm Maximo Application Suite. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-4820?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-4820 have an EU (EUVD) identifier?: Yes. CVE-2026-4820 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18068.
When was CVE-2026-4820 published?: CVE-2026-4820 was published on 2026-04-01 and last updated on 2026-06-17.

References

https://www.ibm.com/support/pages/node/7268028

Affected products (1)

cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*

More vulnerabilities in Ibm Maximo Application Suite

CVE-2025-36386 — Critical (CVSS 9.8): IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass…
CVE-2024-27266 — High (CVSS 8.2): IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML…
CVE-2025-2898 — High (CVSS 7.5): IBM Maximo Application Suite 9.0 could allow an attacker with some level of access to elevate their privileges due to a…
CVE-2024-22328 — High (CVSS 7.5): IBM Maximo Application Suite 8.10 and 8.11 could allow a remote attacker to traverse directories on the system. An…
CVE-2021-38924 — High (CVSS 7.5): IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 could allow a remote attacker to obtain sensitive information when a…
CVE-2021-29854 — High (CVSS 7.2): IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation…

All CVEs affecting Ibm Maximo Application Suite →

Other CWE-319 (Cleartext Transmission of Sensitive Information) vulnerabilities

CVE-2025-4378 — Critical (CVSS 10.0): Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University…
CVE-2025-47419 — Critical (CVSS 10.0): Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network…
CVE-2026-48902 — Critical (CVSS 9.8): The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't…
CVE-2025-34271 — Critical (CVSS 9.8): Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when…
CVE-2025-32880 — Critical (CVSS 9.8): An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a…
CVE-2025-26199 — Critical (CVSS 9.8): CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application…

Browse all CWE-319 (Cleartext Transmission of Sensitive Information) vulnerabilities →