Remote Code Execution in IBM Maximo AI Service

IBM Maximo AI Service, specifically versions 9.1.0 and 9.2.0, contains a critical vulnerability identified as CVE-2026-90920. The flaw arises from improper control of code generation within the application, which may allow an unauthenticated remote attacker to execute arbitrary code. This vulnerability carries a CVSS v3.1 base score of 9.8, reflecting the high risk to organizational security. Given the nature of the AI service, successful exploitation could lead to full system compromise, data exfiltration, or the deployment of persistent malicious payloads within the Maximo environment. Defenders should prioritize patching affected instances to the latest secure version provided by IBM to mitigate the risk of unauthorized access and remote execution.

Impact

Successful exploitation of CVE-2026-90920 allows unauthenticated remote attackers to execute arbitrary code on the affected server. This can result in complete system compromise, unauthorized access to sensitive maintenance and operational data, and potential lateral movement within the network. The vulnerability poses a significant risk to industrial and enterprise environments relying on IBM Maximo for asset and work management.

Recommendation

• Identify all instances of IBM Maximo AI Service within the environment.
• Review IBM security bulletins for the latest firmware or patch release addressing CVE-2026-90920 and apply updates immediately.
• Isolate internet-facing instances of the affected service if immediate patching is not possible.
• Review web access logs for anomalous POST requests or unusual patterns targeting the Maximo AI service endpoints until a patch is applied.