CVE-2026-105052 (GCVE-0-2026-105052)
Vulnerability from cvelistv5 – Published: 2026-10-12 21:01 – Updated: 2026-10-13 13:48
VLAI
EPSS
VEX
Title
IBM Maximo Application Suite Information Disclosure
Summary
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:22 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7290791 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| IBM | Maximo Application Suite |
Affected:
8.10
Affected: 8.11 Affected: 9.0 Affected: 9.1 Affected: 9.2 cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:22:16.531798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:48:38.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*"
],
"product": "Maximo Application Suite",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.10"
},
{
"status": "affected",
"version": "8.11"
},
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.1"
},
{
"status": "affected",
"version": "9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.\u003c/p\u003e"
}
],
"value": "IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:05:04.599Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7290791"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA fix has been released for all supported MAS versions and will also be included in the next \u003ca href=\"https://www.ibm.com/support/pages/node/6570601\" rel=\"nofollow\"\u003emonthly update\u003c/a\u003e. We strongly recommend applying this fix immediately rather than waiting for the monthly update.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eRemediated Product(s)\u003c/td\u003e\u003ctd\u003eMas Verision(s)\u003c/td\u003e\u003ctd\u003eCoreIdp Version(s)\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.10.37\u003c/td\u003e\u003ctd\u003e3.2.201\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.11.34\u003c/td\u003e\u003ctd\u003e4.0.179\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.0.32\u003c/td\u003e\u003ctd\u003e5.1.148\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.1.26\u003c/td\u003e\u003ctd\u003e6.3.60\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.2.7\u003c/td\u003e\u003ctd\u003e8.1.36\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e"
}
],
"value": "A fix has been released for all supported MAS versions and will also be included in the next monthly update https://www.ibm.com/support/pages/node/6570601 . We strongly recommend applying this fix immediately rather than waiting for the monthly update.\n\nRemediated Product(s)Mas Verision(s)CoreIdp Version(s)IBM Maximo Application Suite8.10.373.2.201IBM Maximo Application Suite8.11.344.0.179IBM Maximo Application Suite9.0.325.1.148IBM Maximo Application Suite9.1.266.3.60IBM Maximo Application Suite9.2.78.1.36"
}
],
"title": "IBM Maximo Application Suite Information Disclosure",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHow To Apply the Fix\u003c/p\u003e\u003col\u003e\u003cli\u003eOpen the OpenShift console and navigate to \u003cstrong\u003eAdministration \u0026gt; CustomResourceDefinitions\u003c/strong\u003e.\u00a0\u003c/li\u003e\u003cli\u003eSearch for \u003cstrong\u003ecoreidp.\u003c/strong\u003e\u003c/li\u003e\u003cli\u003eShow coreidp instances.\u003c/li\u003e\u003cli\u003eSelect the instance associated with your MAS installation;\u003c/li\u003e\u003cli\u003eEdit Coreidp CR for your instance with the following under spec.settings field:\u003c/li\u003e\u003cli\u003eUnder the \u003ccode\u003espec.settings\u003c/code\u003e field, add the following configuration, replacing \u003ccode\u003e\u0026lt;version\u0026gt;\u003c/code\u003e with the value specified in the table above for your MAS release:\u003cbr/\u003e\u003cpre\u003e\u003ccode\u003espec:\n settings:\n imageTags:\n coreidplogin: \u0026lt;version\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eSave the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\u003c/li\u003e\u003cli\u003eWait for the new deployment to become ready, then follow the validation steps below.\u00a0\u003cbr/\u003e\u003cstrong\u003e\u003cbr/\u003eIMPORTANT\u003c/strong\u003e: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.\u003cbr/\u003e\u003cbr/\u003e\u003cp\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e"
}
],
"value": "How To Apply the Fix\n\n * Open the OpenShift console and navigate to Administration \u003e CustomResourceDefinitions.\u00a0\n * Search for coreidp.\n * Show coreidp instances.\n * Select the instance associated with your MAS installation;\n * Edit Coreidp CR for your instance with the following under spec.settings field:\n * Under the spec.settings field, add the following configuration, replacing \u003cversion\u003e with the value specified in the table above for your MAS release:\n\n\nspec:\n settings:\n imageTags:\n coreidplogin: \u003cversion\u003e\n\n\n * Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\n * Wait for the new deployment to become ready, then follow the validation steps below.\u00a0\n\nIMPORTANT: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-105052",
"datePublished": "2026-10-12T21:01:02.786Z",
"dateReserved": "2026-10-02T23:51:23.455Z",
"dateUpdated": "2026-10-13T13:48:38.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-105052",
"date": "2026-10-13",
"epss": "0.00623",
"percentile": "0.48473"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*"
],
"product": "Maximo Application Suite",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.10"
},
{
"status": "affected",
"version": "8.11"
},
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.1"
},
{
"status": "affected",
"version": "9.2"
}
]
}
],
"source": "psirt@us.ibm.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system."
}
],
"id": "CVE-2026-105052",
"lastModified": "2026-10-13T14:17:19.030",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-105052",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:22:16.531798Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-12T21:17:08.300",
"references": [
{
"source": "psirt@us.ibm.com",
"url": "https://www.ibm.com/support/pages/node/7290791"
}
],
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Received",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "psirt@us.ibm.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:22:16.531798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:48:16.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*"
],
"product": "Maximo Application Suite",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.10"
},
{
"status": "affected",
"version": "8.11"
},
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.1"
},
{
"status": "affected",
"version": "9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.\u003c/p\u003e"
}
],
"value": "IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:05:04.599Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7290791"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA fix has been released for all supported MAS versions and will also be included in the next \u003ca href=\"https://www.ibm.com/support/pages/node/6570601\" rel=\"nofollow\"\u003emonthly update\u003c/a\u003e. We strongly recommend applying this fix immediately rather than waiting for the monthly update.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eRemediated Product(s)\u003c/td\u003e\u003ctd\u003eMas Verision(s)\u003c/td\u003e\u003ctd\u003eCoreIdp Version(s)\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.10.37\u003c/td\u003e\u003ctd\u003e3.2.201\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e8.11.34\u003c/td\u003e\u003ctd\u003e4.0.179\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.0.32\u003c/td\u003e\u003ctd\u003e5.1.148\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.1.26\u003c/td\u003e\u003ctd\u003e6.3.60\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Maximo Application Suite\u003c/td\u003e\u003ctd\u003e9.2.7\u003c/td\u003e\u003ctd\u003e8.1.36\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e"
}
],
"value": "A fix has been released for all supported MAS versions and will also be included in the next monthly update https://www.ibm.com/support/pages/node/6570601 . We strongly recommend applying this fix immediately rather than waiting for the monthly update.\n\nRemediated Product(s)Mas Verision(s)CoreIdp Version(s)IBM Maximo Application Suite8.10.373.2.201IBM Maximo Application Suite8.11.344.0.179IBM Maximo Application Suite9.0.325.1.148IBM Maximo Application Suite9.1.266.3.60IBM Maximo Application Suite9.2.78.1.36"
}
],
"title": "IBM Maximo Application Suite Information Disclosure",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHow To Apply the Fix\u003c/p\u003e\u003col\u003e\u003cli\u003eOpen the OpenShift console and navigate to \u003cstrong\u003eAdministration \u0026gt; CustomResourceDefinitions\u003c/strong\u003e.\u00a0\u003c/li\u003e\u003cli\u003eSearch for \u003cstrong\u003ecoreidp.\u003c/strong\u003e\u003c/li\u003e\u003cli\u003eShow coreidp instances.\u003c/li\u003e\u003cli\u003eSelect the instance associated with your MAS installation;\u003c/li\u003e\u003cli\u003eEdit Coreidp CR for your instance with the following under spec.settings field:\u003c/li\u003e\u003cli\u003eUnder the \u003ccode\u003espec.settings\u003c/code\u003e field, add the following configuration, replacing \u003ccode\u003e\u0026lt;version\u0026gt;\u003c/code\u003e with the value specified in the table above for your MAS release:\u003cbr/\u003e\u003cpre\u003e\u003ccode\u003espec:\n settings:\n imageTags:\n coreidplogin: \u0026lt;version\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eSave the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\u003c/li\u003e\u003cli\u003eWait for the new deployment to become ready, then follow the validation steps below.\u00a0\u003cbr/\u003e\u003cstrong\u003e\u003cbr/\u003eIMPORTANT\u003c/strong\u003e: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.\u003cbr/\u003e\u003cbr/\u003e\u003cp\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e"
}
],
"value": "How To Apply the Fix\n\n * Open the OpenShift console and navigate to Administration \u003e CustomResourceDefinitions.\u00a0\n * Search for coreidp.\n * Show coreidp instances.\n * Select the instance associated with your MAS installation;\n * Edit Coreidp CR for your instance with the following under spec.settings field:\n * Under the spec.settings field, add the following configuration, replacing \u003cversion\u003e with the value specified in the table above for your MAS release:\n\n\nspec:\n settings:\n imageTags:\n coreidplogin: \u003cversion\u003e\n\n\n * Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically.\n * Wait for the new deployment to become ready, then follow the validation steps below.\u00a0\n\nIMPORTANT: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-105052",
"datePublished": "2026-10-12T21:01:02.786Z",
"dateReserved": "2026-10-02T23:51:23.455Z",
"dateUpdated": "2026-10-13T13:48:38.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…