CVE-2017-1604: IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting.

Security readout for executives and security teams

IBM Maximo Anywhere 7.5 and 7.6 can allow JavaScript to be embedded in its Web UI. In a trusted user session, that script could alter the interface and potentially expose credentials. This matters most where Maximo Anywhere is still deployed on the listed older versions. Exposure is limited to organizations running the listed IBM Maximo Anywhere 7.5 or 7.6 versions. The sources do not state whether affected deployments are internet-facing or require authentication, so assess actual exposure from your deployment architecture. Treat this as a targeted legacy-platform risk, not an internet-wide emergency based on the provided evidence. Prioritize if Maximo Anywhere is still used for operational workflows, exposed beyond a small trusted user base, or handles sensitive maintenance and asset data. Mitigation focus: Identify any IBM Maximo Anywhere deployments and their exact versions.; Review IBM advisory swg22011883 and X-Force 132851 for vendor fix guidance.; Apply IBM-provided updates or configuration guidance where available..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.