Description
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.
Published: 2026-10-12
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

IBM Maximo AI Service versions 9.1.0 and 9.2.0 allow a remote attacker to cause a denial of service by sending malformed frames that the system improperly processes, leading to host process termination. The flaw is a type of buffer or array index validation failure (CWE‑130) that disrupts availability.

Affected Systems

IBM Maximo AI Service, specifically the 9.1.0 and 9.2.0 releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.5, indicating moderate to high risk, and is not currently listed in the CISA KEV catalog. There is no EPSS score available, so exploit probability is unknown, but the lack of known exploits does not mitigate the need for patching. An attacker would need remote access to the Maximo AI Service endpoint and the ability to craft malformed frames to trigger the crash.

Generated by OpenCVE AI on October 13, 2026 at 01:12 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading  Remediated Product(s)Version(s)Maximo AI Service9.1.19 or the latest (available from the Catalog under Update Available) https://www.ibm.com/docs/en/mas-cd/continuous-delivery Maximo AI Service9.2.3 or the latest (available from the Catalog under Update Available) https://www.ibm.com/docs/en/mas-cd/continuous-delivery

OpenCVE Recommended Actions

  • Upgrade IBM Maximo AI Service to 9.1.19 or later, or to 9.2.3 or later, as recommended by IBM.
  • Apply any official configuration changes or service restarts recommended by IBM after the upgrade to ensure the new code is loaded.
  • If an immediate update is not feasible, deploy network filtering or rate-limiting on traffic destined for the Maximo AI Service to reduce the likelihood of triggering the flaw.

Generated by OpenCVE AI on October 13, 2026 at 01:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.
Title Maximo AI Service Denial of Service
First Time appeared Ibm
Ibm maximo Ai Service
Weaknesses CWE-130
CPEs cpe:2.3:a:ibm:maximo_ai_service:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_ai_service:9.2.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm maximo Ai Service
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Maximo Ai Service
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-13T14:39:09.378Z

Reserved: 2026-09-14T11:07:15.825Z

Link: CVE-2026-90921

cve-icon Vulnrichment

Updated: 2026-10-13T14:29:56.097Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T22:17:05.813

Modified: 2026-10-13T16:17:14.080

Link: CVE-2026-90921

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T04:45:07Z

Weaknesses
  • CWE-130

    Improper Handling of Length Parameter Inconsistency