CVE-2011-4818: Open redirect vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7....

Security readout for executives and security teams

This issue lets an authenticated user make IBM Maximo send someone to an arbitrary website through a crafted application URL. The main business risk is phishing that appears to start from a trusted Maximo system. The source bundle does not show active exploitation or a CVSS score. Exposure is limited to organizations running the listed IBM Maximo products and versions. Because the attack requires a remote authenticated user, externally accessible Maximo portals or broad user access raise practical risk. The provided affected CPE data is incomplete, so confirm versions directly. Treat this as a moderate-priority trust and phishing issue, especially for internet-facing or widely used Maximo systems. It does not appear to be KEV-listed or proven actively exploited from the provided sources, but it can undermine user trust in operational systems. Mitigation focus: Check IBM guidance for CVE-2011-4818 and APAR IV09200 before choosing a fix path.; Identify and prioritize Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 deployments.; Limit external access to affected Maximo instances where business operations allow..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.