CVE Intelligence
Analysis AI-assisted

CVE-2026-90920: IBM Maximo AI Service - Code Injection

IBM has disclosed a code injection weakness (CWE-94) in IBM Maximo AI Service versions 9.1.0 and 9.2.0 that could allow a remote attacker to execute arbitrary code. The NVD and CVE records list a CVSS v3.1 base score of 9.8 (Critical), but the sources consulted show no confirmed exploitation. Organizations running the affected versions should review the IBM support advisory and confirm the applicable fix before relying on any remediation step.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM Maximo AI Service versions 9.1.0 and 9.2.0 are affected by CVE-2026-90920, classified as CWE-94 (Code Injection). The record describes improper control of code generation that could let a remote attacker execute arbitrary code. The record was published on 2026-10-12 and is still marked Awaiting Analysis in the consulted data.

Impact

  • The NVD and IBM PSIRT entries report a CVSS v3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The vector describes network attack, low complexity, no privileges required and no user interaction, with high impact to confidentiality, integrity and availability.
  • The SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • IBM Maximo AI Service version 9.1.0
  • IBM Maximo AI Service version 9.2.0

The record lists no fixed versions. The IBM reference is tagged as a vendor advisory and patch, but its content was not part of the record, so fixed versions are unknown.

Exploitation status

This CVE is not listed in the CISA KEV data provided. No confirmed exploitation appears in the sources consulted. EPSS gives a probability of 0.00544 (about 0.54%) with a percentile of 0.44125, dated 2026-10-13. The SSVC exploitation value is none.

Remediation and mitigation

  • Identify every IBM Maximo AI Service instance running version 9.1.0 or 9.2.0.
  • Review the IBM support advisory for the vendor fix or interim guidance and apply it through your change process.
  • Because the vector describes network access without authentication, prioritize limiting exposure of the service to trusted network segments until patching is complete.
  • If no fix is yet available for your version, monitor vendor updates and keep the service isolated from untrusted networks.

Detection guidance

  • Monitor service hosts for unexpected process creation, unusual outbound connections or unexpected changes to application files.
  • Review application and access logs for anomalous requests to AI-related components of the platform.
  • Correlate alerts with your asset inventory to confirm which hosts run the affected versions.

Limitations of the available information

  • The record does not include a fixed version, a detailed technical root cause or evidence of exploitation.
  • The specific component inside the product is not named in the description.
  • Details of the fix and any workarounds must be verified directly with IBM, since the advisory content was not included in the record.

Frequently asked questions

Which versions of IBM Maximo AI Service are affected?

The record lists IBM Maximo AI Service version 9.1.0 and version 9.2.0 as affected.

Is a fixed version available?

The record does not list any fixed version. Check the IBM support advisory referenced in the record to confirm the fix for your version.

Is this vulnerability confirmed as exploited?

It is not listed in the CISA KEV data provided, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.