The vulnerability in IBM Maximo AI Service allows a remote attacker to cause a denial of service by inducing uncontrolled resource consumption within the service. This flaw is a classic instance of CWE-400, where insufficient checks on inputs or requests can lead to excessive use of system resources. An attacker can trigger the condition by sending specially crafted requests that prompt the service to process data without rate limiting, leading to CPU or memory exhaustion and a service crash or hang. The impact is limited to availability, with no direct effect on confidentiality or integrity.

Affecting the Maximo AI Service 9.1.0 and 9.2.0 releases, the issue is documented for IBM versions starting at those baseline numbers. IBM recommends upgrading to Maximo AI Service 9.1.19 or any later 9.1.x release, and to 9.2.3 or any later 9.2.x release. The affected environments should be identified by checking the installed product version against these baseline numbers before applying the update. For environments still on 9.1.0 or 9.2.0, action is required.

With a CVSS score of 7.5, this vulnerability is considered high severity. The EPSS score is not available, and it has not yet been listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Nevertheless, the attack vector is remote, and the conditions for exploitation are minimal: an off‑site attacker can send inputs to the AI Service without needing authentication or elevated privileges. Given the absence of a documented exploit but the high potential for service disruption, organizations should treat this as a high‑risk issue until a patch is applied.