{"api_version":"1","generated_at":"2026-08-05T20:40:01+00:00","cve":"CVE-2026-15656","urls":{"html":"https://cve.report/CVE-2026-15656","api":"https://cve.report/api/cve/CVE-2026-15656.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-15656","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-15656"},"summary":{"title":"IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret","description":"IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-08-05 16:16:51","updated_at":"2026-08-05 19:17:24"},"problem_types":["CWE-614","CWE-614 CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7282362","name":"https://www.ibm.com/support/pages/node/7282362","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15656","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15656","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Maximo Application Suite","version":"affected 9.2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Maximo Application Suite","version":"affected 9.1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Maximo Application Suite","version":"affected 9.0","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Remediated Product(s)Version(s)IBM Maximo Application Suite9.2.1IBM Maximo Application Suite9.1.20IBM Maximo Application Suite9.0.28","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-15656","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-05T18:13:49.898225Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-05T18:41:26.341Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*"],"product":"Maximo Application Suite","vendor":"IBM","versions":[{"status":"affected","version":"9.2"},{"status":"affected","version":"9.1"},{"status":"affected","version":"9.0"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.</p>"}],"value":"IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-614","description":"CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-05T16:05:53.843Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7282362"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><table><tbody><tr><td>Remediated Product(s)</td><td>Version(s)</td></tr><tr><td>IBM Maximo Application Suite</td><td>9.2.1</td></tr><tr><td>IBM Maximo Application Suite</td><td>9.1.20</td></tr><tr><td>IBM Maximo Application Suite</td><td>9.0.28</td></tr></tbody></table></div>"}],"value":"Remediated Product(s)Version(s)IBM Maximo Application Suite9.2.1IBM Maximo Application Suite9.1.20IBM Maximo Application Suite9.0.28"}],"title":"IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-15656","datePublished":"2026-08-05T16:05:53.843Z","dateReserved":"2026-07-13T19:48:38.363Z","dateUpdated":"2026-08-05T18:41:26.341Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-05 16:16:51","lastModifiedDate":"2026-08-05 19:17:24","problem_types":["CWE-614","CWE-614 CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-05T18:13:49.898225Z","id":"CVE-2026-15656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"15656","Ordinal":"1","Title":"IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 whic","CVE":"CVE-2026-15656","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"15656","Ordinal":"1","NoteData":"IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.","Type":"Description","Title":"IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 whic"}]}}}