Dashboard / CVE-2026-4820

CVE-2026-4820

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 59/100
Published: 2026-04-01 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Unchanged
C: Low
I: None
A: None

Description

IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

Weakness Classification (2)

Affected Software (4)

VendorProductVersion
ibm maximo_application_suite 8.10 – 8.10.33
ibm maximo_application_suite 8.11 – 8.11.30
ibm maximo_application_suite 9.0 – 9.0.19
ibm maximo_application_suite 9.1 – 9.1.8

References & Advisories (1)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS — Exploitation Probability

0.12%
Raw Score 0.001200
Percentile 1.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00120
2026-10-28
0.00118

Intelligence Sources

nvd ref →

External Links