Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-90920: IBM Maximo AI Service can run attacker code
CVE-2026-90920 · published today
Summary
The IBM Maximo AI Service versions 9.1.0 and 9.2.0 may let someone on the network cause the system to run their own code. This could let an attacker take control of the service or access data it handles. Apply the latest security update from IBM as soon as possible to stop this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | maximo ai service | 9.1.0 |
Original advisory text
Maximo AI Service Code Injection
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
References
- https://www.ibm.com/support/pages/node/7290833 vendor-advisory patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-94Code Injection
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta