LiveActive security incident?Get immediate response
CVE Record

CVE-2021-20443: IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a sour...

IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intended control sphere. IBM X-Force ID: 196619.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

IBM Maximo for Civil Infrastructure 7.6.2 can include executable functionality, such as a library, from outside the intended trust boundary. In business terms, a legitimate Maximo deployment may run code that is not fully controlled as intended, creating confidentiality, integrity, and availability risk.

Executive priority

Treat as a moderate-priority remediation item for affected Maximo environments. Prioritize internet-facing or broadly accessible deployments, but avoid emergency escalation unless IBM or CISA later reports active exploitation.

Technical view

The CVE describes executable functionality from outside the intended control sphere in IBM Maximo for Civil Infrastructure 7.6.2. CVSS 3.0 is 6.3: network attack vector, low privileges required, low complexity, no user interaction, unchanged scope, and low impact to confidentiality, integrity, and availability.

Likely exposure

Exposure appears limited to organizations running IBM Maximo for Civil Infrastructure 7.6.2. Risk increases where Maximo is network-reachable and low-privileged authenticated users can access affected functionality.

Exploitation context

The provided bundle does not show active exploitation, and the CVE is not listed as KEV. IBM X-Force tracks it as 196619, but the provided evidence does not include exploit details.

Researcher notes

The source bundle is sparse: no CWE is listed, and no detailed exploit path is provided. Base validation on product/version matching, network exposure, privilege model, and IBM advisory status rather than inferred vulnerable components.

Mitigation direction

  • Review IBM support advisory 6415883 for the official remediation.
  • Apply IBM-provided fixes or updates for affected 7.6.2 deployments.
  • Restrict Maximo access to trusted networks and users.
  • Reduce low-privileged account access to only required functions.
  • Monitor Maximo logs for unexpected executable or library behavior.

Validation and detection

  • Inventory Maximo deployments and confirm exact product version.
  • Check whether any system runs Maximo for Civil Infrastructure 7.6.2.
  • Verify IBM advisory remediation has been applied.
  • Review network exposure for affected Maximo instances.
  • Confirm privileged and low-privileged user access is appropriate.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-20443 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/PR:L/AC:L/A:L/AV:N/UI:N/I:L/C:L/S:U/E:U/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.0MediumCVSS:3.0/PR:L/AC:L/A:L/AV:N/UI:N/I:L/C:L/S:U/E:U/RL:O/RC:C2.83.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.3Medium
CVSS 3.0 vector shape for CVE-2021-20443Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/PR:L/AC:L/A:L/AV:N/UI:N/I:L/C:L/S:U/E:U/RL:O/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMMaximo for Civil Infrastructure7.6.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.