Critical IBM Maximo Flaw (CVE-2025-36386, CVSS 9.8) Allows Unauthenticated Bypass to Cognos Analytics

IBM has issued a critical security notice for Maximo Manage in the Maximo Application Suite, warning of a high-severity vulnerability (CVE-2025-36386, CVSS 9.8) that could allow an unauthenticated remote attacker to bypass authentication and access Cognos Analytics.

According to the advisory, the flaw arises from how MXCSP handles authentication requests during the integration between Maximo Manage and Cognos Analytics, and it affects MAS versions from 9.0.0 to 9.0.15 (Manage 9.0.0 to 9.0.17) and from 9.1.0 to 9.1.4 (Manage 9.1.0 to 9.1.4). IBM notes the remote exploitability and the potential exposure of sensitive analytics data, and has issued patches for both major MAS branches.

A successful exploit could allow an attacker to access and manipulate Cognos dashboards and reports, or extract or alter analytics data, with the possibility of chaining the bypass to escalate privileges within Maximo environments. IBM is urging affected customers to apply the latest fixes immediately, as reported on 29 October 2025.