The vulnerability exists in IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS versions, allowing a remote attacker to trigger uncontrolled recursion that can exhaust system resources and cause a denial of service. The flaw arises from a lack of depth checking in the AI processing logic, which is a classic instance of CWE‑674. An attacker can initiate the recursion by sending crafted requests, rendering the service unresponsive.

IBM Maximo AI Service SaaS deployments running version 9.1.0 or 9.2.0 are affected. IBM recommends upgrading to Maximo AI Service 9.1.19 or newer for the 9.1 line, or to 9.2.3 or newer for the 9.2 line, which removes the recursion issue.

With a CVSS base score of 7.5, this issue is considered high severity. The EPSS score is not available, so exploitation likelihood cannot be quantified, and it is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nevertheless, the flaw can be exploited remotely without authentication if an attacker can reach the service and send the trigger, making the risk significant in environments lacking strong network segmentation.