CVE-2026-4820

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4820", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-03-25T13:48:17.676Z", "datePublished": "2026-04-01T20:54:09.417Z", "dateUpdated": "2026-04-02T15:51:44.073Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-01T20:54:09.417Z"}, "title": "IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-614", "description": "CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Maximo Application Suite", "versions": [{"status": "affected", "version": "9.1.0", "lessThanOrEqual": "10.6.5.0", "versionType": "semver"}, {"status": "affected", "version": "9.0", "versionType": "semver"}, {"status": "affected", "version": "8.11.0", "versionType": "semver"}, {"status": "affected", "version": "8.10", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7268028", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Remediated Product(s)Version(s)IBM Maximo Application Suite9.1.8IBM Maximo Application Suite9.0.19IBM Maximo Application Suite8.11.30IBM Maximo Application Suite8.10.33", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table><tbody><tr><td>Remediated Product(s)</td><td>Version(s)</td></tr><tr><td>IBM Maximo Application Suite</td><td>9.1.8</td></tr><tr><td>IBM Maximo Application Suite</td><td>9.0.19</td></tr><tr><td>IBM Maximo Application Suite</td><td>8.11.30</td></tr><tr><td>IBM Maximo Application Suite</td><td>8.10.33</td></tr></tbody></table>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T15:51:25.221671Z", "id": "CVE-2026-4820", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T15:51:44.073Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T15:51:25.221671Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T15:51:31.995Z"}}], "cna": {"title": "IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Maximo Application Suite", "versions": [{"status": "affected", "version": "9.1.0", "versionType": "semver", "lessThanOrEqual": "10.6.5.0"}, {"status": "affected", "version": "9.0", "versionType": "semver"}, {"status": "affected", "version": "8.11.0", "versionType": "semver"}, {"status": "affected", "version": "8.10", "versionType": "semver"}]}], "solutions": [{"lang": "en", "value": "Remediated Product(s)Version(s)IBM Maximo Application Suite9.1.8IBM Maximo Application Suite9.0.19IBM Maximo Application Suite8.11.30IBM Maximo Application Suite8.10.33", "supportingMedia": [{"type": "text/html", "value": "<table><tbody><tr><td>Remediated Product(s)</td><td>Version(s)</td></tr><tr><td>IBM Maximo Application Suite</td><td>9.1.8</td></tr><tr><td>IBM Maximo Application Suite</td><td>9.0.19</td></tr><tr><td>IBM Maximo Application Suite</td><td>8.11.30</td></tr><tr><td>IBM Maximo Application Suite</td><td>8.10.33</td></tr></tbody></table>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7268028", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-614", "description": "CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-01T20:54:09.417Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4820", "state": "PUBLISHED", "dateUpdated": "2026-04-02T15:51:44.073Z", "dateReserved": "2026-03-25T13:48:17.676Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-04-01T20:54:09.417Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*"], "product": "Maximo Application Suite", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.6.5.0", "status": "affected", "version": "9.1.0", "versionType": "semver"}, {"status": "affected", "version": "9.0", "versionType": "semver"}, {"status": "affected", "version": "8.11.0", "versionType": "semver"}, {"status": "affected", "version": "8.10", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "31F32ACF-51E7-490F-BC1B-431F002FCA49", "versionEndExcluding": "8.10.33", "versionStartIncluding": "8.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "0157833D-F63E-4B9B-B51C-D9FFD7AD0167", "versionEndExcluding": "8.11.30", "versionStartIncluding": "8.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7367CAC-E918-46BA-99D2-23397732FD90", "versionEndExcluding": "9.0.19", "versionStartIncluding": "9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7858D3F-F186-489A-A651-F4BFAE27A72C", "versionEndExcluding": "9.1.8", "versionStartIncluding": "9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic."}, {"lang": "es", "value": "IBM Maximo Application Suite 9.1, 9.0, 8.11 y 8.10 no establece el atributo \u2019secure\u2019 en los tokens de autorizaci\u00f3n o las cookies de sesi\u00f3n. Los atacantes podr\u00edan obtener los valores de las cookies enviando un enlace HTTP:// a un usuario o insertando este enlace en un sitio al que el usuario accede. La cookie se enviar\u00e1 al enlace inseguro y el atacante podr\u00e1 entonces obtener el valor de la cookie interceptando el tr\u00e1fico."}], "id": "CVE-2026-4820", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4820", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T15:51:25.221671Z", "version": "2.0.3"}}]}, "published": "2026-04-01T21:17:02.827", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7268028"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-614"}], "source": "psirt@us.ibm.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.1.0,10.6.5.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.11.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.10"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Maximo Application Suite", "source": "cna", "vendor": "IBM"}, "product": "maximo_application_suite", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-07T23:37:20.166977+00:00", "value": {"mitigation_remediation": ["Apply the IBM Maximo Application Suite updates to version 9.1.8, 9.0.19, 8.11.30, or 8.10.33 as provided by IBM.", "Verify that authentication tokens and session cookies now include the secure flag and are only transmitted over HTTPS.", "Monitor network traffic for any unsecured cookie transmission and enforce HTTPS enforcement across all Maximo Application Suite interfaces."], "summary": {"action": "Patch Now", "impact": "Session Token Theft"}, "threat_synthesis": {"affected_systems": "IBM Maximo Application Suite versions 9.1.x up to 9.1.8, 9.0.x up to 9.0.19, 8.11.x up to 8.11.30, and 8.10.x up to 8.10.33 are affected.", "description_and_impact": "The vulnerability arises from IBM Maximo Application Suite failing to mark authentication tokens and session cookies with the secure flag, enabling them to be transmitted over non\u2011HTTPS connections. Attackers can trigger the cookie to be sent to an insecure http:// URL by embedding the link in a phishing page or a site the user visits. When transmitted insecurely, the cookie values can be captured by an attacker through traffic sniffing, allowing session hijacking and unauthorized access to the system.", "risk_and_exploitability": "The CVSS score is 4.3, indicating moderate risk, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation is achievable remotely via a web link, requiring an attacker to supply an http:// URL that a user visits, making the risk dependent on user interaction with potential phishing or compromised sites."}}}}, "created": "2026-04-02T07:47:28.323920+00:00", "title": "Secure Flag Missing on Authentication Tokens in IBM Maximo Application Suite", "updated": "2026-04-08T19:56:50.663076+00:00", "vendors": ["ibm", "ibm$PRODUCT$maximo_application_suite"]}