Introduction
An attacker with unauthorized access to an enterprise asset management system can disrupt operations at utilities, manufacturers, and critical infrastructure operators. CVE-2025-36386 is a single authentication flaw that can expose sensitive operational data and controls to remote attackers.
About IBM Maximo Application Suite: IBM Maximo Application Suite is an enterprise asset management platform used around the world in energy, transportation, manufacturing, and other sectors. It is one of IBM's flagship products, with thousands of deployments worldwide, and large organizations use it in their digital transformation and operational efficiency work.
Technical Information
CVE-2025-36386 is classified as CWE-305 (Authentication Bypass by Primary Weakness). A remote attacker can use it to bypass authentication and gain unauthorized access to IBM Maximo Application Suite. It affects versions 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4.
The root cause has not been publicly disclosed. Similar authentication bypasses in IBM Maximo products have been linked to improper access controls, misconfigured user group permissions, or incorrect values for authentication properties such as mxe.int.enableosauth. CVE-2023-32333 involved an improperly configured MAXREG user, and CVE-2022-40616 was related to a disabled authentication property. No public code snippets or proof of concept are available for CVE-2025-36386. The vulnerability can be exploited remotely, with no prior authentication and no user interaction.
Affected Systems and Versions
- IBM Maximo Application Suite 9.0.0 through 9.0.15
- IBM Maximo Application Suite 9.1.0 through 9.1.4
All configurations of these versions are considered vulnerable unless IBM specifies otherwise.
Vendor Security History
IBM has shipped authentication-related vulnerabilities in Maximo products before, including:
- CVE-2023-32333: Authentication bypass due to improper access controls in Maximo Asset Management (IBM advisory).
- CVE-2022-40616: Authentication bypass related to the
mxe.int.enableosauthproperty (Cybersecurity Help advisory).
IBM usually publishes security bulletins and patches promptly, but the repeated authentication bugs suggest an ongoing weakness in how Maximo handles authentication.
