{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aibmmaximo_ai_service9.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:maximo_ai_service:9.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_ai_service:9.2.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-90920"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Maximo AI Service (9.1.0, 9.2.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM Maximo AI Service, specifically versions 9.1.0 and 9.2.0, contains a critical vulnerability identified as CVE-2026-90920. The flaw arises from improper control of code generation within the application, which may allow an unauthenticated remote attacker to execute arbitrary code. This vulnerability carries a CVSS v3.1 base score of 9.8, reflecting the high risk to organizational security. Given the nature of the AI service, successful exploitation could lead to full system compromise, data exfiltration, or the deployment of persistent malicious payloads within the Maximo environment. Defenders should prioritize patching affected instances to the latest secure version provided by IBM to mitigate the risk of unauthorized access and remote execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-90920 allows unauthenticated remote attackers to execute arbitrary code on the affected server. This can result in complete system compromise, unauthorized access to sensitive maintenance and operational data, and potential lateral movement within the network. The vulnerability poses a significant risk to industrial and enterprise environments relying on IBM Maximo for asset and work management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM Maximo AI Service within the environment.\u003c/li\u003e\n\u003cli\u003eReview IBM security bulletins for the latest firmware or patch release addressing CVE-2026-90920 and apply updates immediately.\u003c/li\u003e\n\u003cli\u003eIsolate internet-facing instances of the affected service if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eReview web access logs for anomalous POST requests or unusual patterns targeting the Maximo AI service endpoints until a patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:39:21Z","date_published":"2026-10-12T22:39:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ibm-maximo-rce/","summary":"IBM Maximo AI Service versions 9.1.0 and 9.2.0 are vulnerable to remote code execution due to improper control of code generation, allowing unauthenticated attackers to execute arbitrary code.","title":"Remote Code Execution in IBM Maximo AI Service","url":"https://feed.craftedsignal.io/briefs/2026-10-ibm-maximo-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ibm:maximo_ai_service:9.2.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}