CVE-2026-15656: IBM Maximo Auth Bypass Vulnerability

CVE-2026-15656 Overview

CVE-2026-15656 affects IBM Maximo Application Suite versions 9.0, 9.1, and 9.2. The application fails to set the Secure attribute on authorization tokens and session cookies. This omission [CWE-614] allows cookies to travel over unencrypted HTTP connections. An attacker can trick a user into visiting an http:// link, causing the browser to transmit the cookie in cleartext. An adversary positioned on the network path can then capture the cookie by monitoring traffic. Successful exploitation exposes session identifiers and authorization tokens used to access the Maximo Application Suite.

Critical Impact
Authorization tokens and session cookies transmitted over cleartext HTTP can be intercepted by network-positioned attackers, enabling session hijacking against IBM Maximo Application Suite users.

Affected Products

IBM Maximo Application Suite 9.0
IBM Maximo Application Suite 9.1
IBM Maximo Application Suite 9.2

Discovery Timeline

2026-08-05 - CVE-2026-15656 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15656

Vulnerability Analysis

IBM Maximo Application Suite issues authorization tokens and session cookies without the Secure attribute. The Secure attribute instructs browsers to transmit cookies only over HTTPS connections. Without this flag, browsers send the cookie over any protocol, including plaintext HTTP. An attacker can lure an authenticated user to click an http:// link pointing to the same domain. The browser attaches the cookie to that request in cleartext. Anyone monitoring the network path, such as an operator of an untrusted Wi-Fi network, can capture the cookie and reuse it to impersonate the victim.

Root Cause

The root cause is a missing Secure cookie attribute on session and authorization cookies issued by the Maximo Application Suite. This maps to [CWE-614]: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. The server relies on transport-layer security without enforcing it at the cookie layer. Developers must explicitly set the Secure flag when emitting Set-Cookie response headers.

Attack Vector

Exploitation requires user interaction. The attacker sends an http:// link to the victim through email, chat, or a malicious page embedded on a site the user visits. When the user's browser resolves the link, it attaches the Maximo cookie to the plaintext request. The attacker, positioned on the same network segment or upstream infrastructure, captures the cookie through packet inspection. The captured cookie can then be replayed against the legitimate HTTPS endpoint to hijack the session.

No verified proof-of-concept code is publicly available. See the IBM Support Page for vendor guidance.

Detection Methods for CVE-2026-15656

Indicators of Compromise

Outbound HTTP requests from user workstations to Maximo Application Suite hostnames on port 80.
Set-Cookie response headers from Maximo endpoints that omit the Secure attribute.
Concurrent authenticated Maximo sessions originating from disparate geolocations or IP ranges for a single user.

Detection Strategies

Inspect HTTP response headers from Maximo Application Suite servers and flag any Set-Cookie entries lacking the Secure attribute.
Correlate web proxy logs to identify user agents sending Maximo cookies over cleartext HTTP.
Alert on session tokens reused from a new IP address, user agent, or ASN within a short window.

Monitoring Recommendations

Enable full URL logging on egress web proxies to capture requests to Maximo hostnames using the http scheme.
Instrument the Maximo reverse proxy or load balancer to log all Set-Cookie headers and audit them for the Secure flag.
Track authentication events and session lifetimes in Maximo audit logs and correlate against network telemetry.

How to Mitigate CVE-2026-15656

Immediate Actions Required

Apply the fix documented on the IBM Support Page for CVE-2026-15656.
Force HTTPS on all Maximo Application Suite endpoints and disable listeners on port 80.
Invalidate active sessions and require users to re-authenticate after remediation.
Deploy HTTP Strict Transport Security (HSTS) headers with includeSubDomains on all Maximo hostnames.

Patch Information

Refer to the IBM Support Page for the fix pack and upgrade path applicable to IBM Maximo Application Suite 9.0, 9.1, and 9.2.

Workarounds

Terminate TLS at a reverse proxy and rewrite Set-Cookie headers to append the Secure and HttpOnly attributes.
Enforce HSTS at the perimeter to prevent browsers from issuing plaintext requests to Maximo hostnames.
Block outbound HTTP traffic to Maximo Application Suite domains at the egress firewall until patched.

bash

# Example NGINX reverse proxy directive to enforce Secure cookies and HSTS
proxy_cookie_flags ~ secure httponly samesite=strict;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
return 301 https://$host$request_uri;