IBM Maximo AI Service 9.1 and 9.2 Face Critical Remote Code Execution Risk
A critical flaw in IBM Maximo AI Service 9.1.0 and 9.2.0 allows remote attackers to run arbitrary code via improper control of code generation.
Key points
- IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a critical vulnerability.
- The National Vulnerability Database assigns CVE-2026-90920 a CVSS score of 9.8.
- The flaw stems from improper control of code generation, enabling remote code execution.
IBM Maximo AI Service versions 9.1.0 and 9.2.0 are affected by a critical security vulnerability that allows remote attackers to execute arbitrary code. The National Vulnerability Database records this issue as CVE-2026-90920, rating it with a CVSS score of 9.8.
At a glance
- CVE
- CVE-2026-90920
- Product
- IBM Maximo AI Service
- CVSS
- 9.8 Critical
- Weakness
- code injection
- Exploited
- No known exploitation
The vulnerability arises from improper control of code generation within the service. According to the NVD record, this weakness falls under CWE-94. Attackers who can reach the affected service remotely may leverage this flaw to run unauthorized commands on the host system.
Context and Background
The National Vulnerability Database serves as the U.S. government’s repository of standards-based vulnerability management data. It provides consistent identifiers and metrics for software flaws to help security professionals prioritize remediation efforts.
A CVSS score of 9.8 indicates a critical severity level. This metric reflects the high potential impact and ease of exploitation associated with the flaw. Security teams typically treat such high scores as immediate priorities for investigation and mitigation planning.
Who Is Affected
Only specific versions of IBM Maximo AI Service are impacted by this advisory. The affected releases are version 9.1.0 and version 9.2.0. Organizations running these exact builds must assess their exposure immediately.
Users of earlier or later versions are not listed as affected in the current NVD entry. However, organizations should verify their installed versions to ensure they are not running vulnerable builds. IBM provides support resources for customers to check their software status.
What should you do?
Security teams should isolate affected systems from untrusted networks if possible. Monitor vendor communications for an official update or advisory. Verify installed versions to confirm exposure.
What to do and how to stay safe: IBM
- Verify the installed version of IBM Maximo AI Service to confirm if it is 9.1.0 or 9.2.0.
- Isolate vulnerable instances from external networks to limit remote access until a fix is available.
- Monitor IBM security advisories and the NVD for updates regarding CVE-2026-90920.
- Review network logs for unusual outbound traffic or unexpected code execution from affected systems.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-90920?
The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability, rating it as critical.
Which versions of IBM Maximo AI Service are affected?
Versions 9.1.0 and 9.2.0 of IBM Maximo AI Service are affected by this remote code execution flaw.
What type of weakness causes this vulnerability?
The flaw is caused by improper control of code generation, classified under CWE-94 in the NVD record.
