CVE-2015-5016: IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk...

Security readout for executives and security teams

This is an IBM asset and service management information disclosure issue. A logged-in user could bypass intended restrictions and read ticket worklog entries they should not see. Worklogs may contain operational details, internal communications, or sensitive service information, so the main risk is confidentiality rather than system takeover. Exposure is most likely where affected IBM Maximo, Control Desk, or Tivoli Asset Management deployments remain in use and allow broad authenticated user access. Risk increases if ticket worklogs contain sensitive operational, customer, or incident details. Treat this as a confidentiality and access-control issue for business systems that may hold sensitive operational records. Prioritize environments with broad user populations, customer-facing support data, or incident response worklogs. Mitigation focus: Inventory affected IBM product deployments and versions.; Review IBM X-Force and IBM support guidance for fixed levels or interim fixes.; Restrict access to affected applications to trusted users and networks..

Prepared

Jun 7, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.