Threat level Severe
Contact
Critical 9.8
CVE-2026-90920

IBM Maximo AI Service — remote code execution.

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

WeaknessCWE-94: Code injection
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.5%
Higher than 45% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

What to do

  1. 01Check whether you run IBM Maximo AI Service, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
IBM47 CVEs in 30 days
All IBM CVEs

Other CVEs from IBM

40+ more CVEs

All IBM CVEs
9.8Langflow — security bypass.EPSS 2.2%9.8Langflow — remote code execution.EPSS 0.6%8.8Langflow — remote code execution.EPSS 0.7%8.8Langflow — remote code execution.EPSS 0.9%8.8Langflow — remote code execution.EPSS 0.9%9.8Langflow — remote code execution.EPSS 0.7%