CVE-2018-1528: IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive informa...

Security readout for executives and security teams

IBM Maximo Asset Management 7.6 through 7.6.3 exposes sensitive information through the WhoAmI API to an authenticated user. This is not a remote unauthenticated takeover risk, but it can disclose data useful for privilege mapping or follow-on attacks in environments where Maximo supports critical asset operations. Exposure is most likely where affected Maximo versions remain deployed and authenticated users can reach the WhoAmI API. Internet exposure increases concern, but the bundle does not state deployment prevalence or default exposure. Handle in normal vulnerability management with priority for exposed or critical-operations Maximo systems. The business risk is sensitive information leakage that may support later attacks, not direct system compromise based on the provided evidence. Mitigation focus: Review IBM advisory swg22017450 for the official fix or upgrade path.; Prioritize remediation for internet-reachable or broadly accessible Maximo deployments.; Limit Maximo access to required users and roles only..

Prepared

Jun 1, 2026, 14:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.