Description
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
Published: 2026-10-12
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

IBM Maximo AI Service 9.1.0 and 9.2.0 contain a code injection flaw caused by improper control of code generation (CWE‑94). The vulnerability enables a remote attacker to craft input that is interpreted as executable code, allowing the attacker to run arbitrary instructions with the privileges of the service. This can lead to full system compromise, data theft, and further lateral movement.

Affected Systems

The affected products are IBM Maximo AI Service versions 9.1.0 and 9.2.0. IBM has released remediation in versions 9.1.19 and 9.2.3, or any later update available from the IBM catalog.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity level. EPSS data is not available, so an exact exploitation probability cannot be stated, but the lack of a KEV listing suggests no public exploitation has yet been documented. The risk remains high because the attack vector is remote and requires no local privileges; an attacker can trigger the flaw by sending malicious input to the service’s code generation endpoint.

Generated by OpenCVE AI on October 13, 2026 at 01:33 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading  Remediated Product(s)Version(s)Maximo AI Service9.1.19 or the latest (available from the Catalog under Update Available) https://www.ibm.com/docs/en/mas-cd/continuous-delivery Maximo AI Service9.2.3 or the latest (available from the Catalog under Update Available) https://www.ibm.com/docs/en/mas-cd/continuous-delivery

OpenCVE Recommended Actions

  • Upgrade Maximo AI Service to version 9.1.19 or later, or 9.2.3 or later, following IBM’s documented update procedures.
  • Temporarily disable or restrict the code generation endpoint so that only authorized users can access it until the upgrade is complete.
  • After applying the patch or restriction, monitor the service logs for any attempt to execute code or suspicious API calls to ensure no exposed vulnerabilities remain.

Generated by OpenCVE AI on October 13, 2026 at 01:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
Title Maximo AI Service Code Injection
First Time appeared Ibm
Ibm maximo Ai Service
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:maximo_ai_service:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_ai_service:9.2.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm maximo Ai Service
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Maximo Ai Service
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-13T14:39:09.252Z

Reserved: 2026-09-14T11:05:19.026Z

Link: CVE-2026-90920

cve-icon Vulnrichment

Updated: 2026-10-13T14:29:54.539Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T22:17:05.683

Modified: 2026-10-13T16:17:14.080

Link: CVE-2026-90920

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T04:30:17Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')