plaincve:~$

// threat brief

CVE-2026-90920

IBM Maximo AI Service code injection: a remote attacker could run arbitrary code on the system

CVSS
9.8 CRITICAL
CISA KEV
Not listed
Weakness
CWE-94
Topics
Infrastructure · AI security

PlainCVE Team · Published 2026-10-13 · AI-assisted · Press brief ↓

AI review 2026-10-13 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

IBM Maximo AI Service 9.1.0 and 9.2.0 have a code injection flaw that could let a remote attacker run code; upgrade to 9.1.19 or 9.2.3.

Who is affectedOrganizations running IBM Maximo AI Service 9.1.0 or 9.2.0. Our analysis: other versions in the same release lines that come before the fixed releases (9.1.19, 9.2.3) are probably affected too, though no source says so directly.
What happensAccording to the CVE record, a remote attacker could run arbitrary code on the system. CVSS 3.1 rates it 9.8 (Critical), with high impact on confidentiality, integrity and availability, no privileges required and no user interaction needed.
What to do nowAs IBM's security bulletin and the CVE record recommend, upgrade the 9.1 line to 9.1.19 and the 9.2 line to 9.2.3, or to the latest version (available from the Catalog under "Update Available"). IBM's bulletin gives no workaround; until you upgrade, the third-party analysis from OffSeq suggests restricting network access to the service.
Affected versions9.1.0 and 9.2.0 (as listed in the CVE record); our analysis is that earlier versions in these release lines, before the fixed releases, are probably affected too
Fixed versions9.1.19 or later (9.1 line), 9.2.3 or later (9.2 line), or the latest version
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2026-10-05

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your version

    The CVE record lists 9.1.0 and 9.2.0 as affected. Our analysis: 9.1-line versions before 9.1.19 and 9.2-line versions before 9.2.3 are probably affected too, but no source confirms this. The sources give no command for checking the version.

  2. 02Watch for suspicious activity (no official detection guidance)

    The evidence contains no detection method or indicators of compromise from IBM. OffSeq suggests monitoring for suspicious activity related to code injection attempts; this is a third-party suggestion.

    Step 2Step 3
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to 9.1.19 / 9.2.3 or the latest

    IBM security bulletin node/7290833 and the CVE record (written by IBM as CNA) both recommend upgrading: the 9.1 line to 9.1.19, the 9.2 line to 9.2.3, or the latest version from the Catalog under "Update Available".

    Step 2Step 3
  2. 02Can't upgrade yet: restrict network access

    IBM's security bulletin lists "Workarounds and Mitigations" as None. OffSeq suggests restricting network access to the service until a fix is applied.

    Step 1
RESPONDRespondIf you find signs of compromise
  1. 01If you suspect compromise, treat the host as taken over

    The sources give no incident response guidance. This is PlainCVE's suggestion: since the impact is arbitrary code execution, if you find suspicious activity, isolate the host, preserve logs, get an investigation, and rebuild on a fixed version.

    Step 4
HARDENHardenPrevent the next one
  1. 01Keep the service off untrusted networks

    Building on OffSeq's advice to restrict network access: let only the systems that need it reach Maximo AI Service.

    Step 1
  2. 02Keep applying AI Service updates

    The 9.1.19 release notes mention "Security fixes"; neither the 9.1.19 nor the 9.2.3 notes name CVE-2026-90920; these versions were only listed as fixes in IBM's later security bulletin. Fixes may ship before the announcement, so regular updates shorten your exposure.

    Step 2
Full remediation steps and notes
Release lineUpgrade to
9.19.1.19 or later, or the latest
9.29.2.3 or later, or the latest
  • The CVE record says the latest version is available from the Catalog under “Update Available”.
  • The 9.1.19 release notes mention “Security fixes”; neither the 9.1.19 nor the 9.2.3 notes name CVE-2026-90920. The link between these versions and this CVE comes from IBM security bulletin node/7290833 and the CVE record.
  • IBM’s security bulletin (2026-10-05) lists the fixed versions as 9.1.19 or latest and 9.2.3 or latest. OffSeq’s machine-generated analysis says no official patch information is available, which does not match IBM’s bulletin.
  • IBM’s bulletin lists “Workarounds and Mitigations” as None and gives no detection guidance; restricting network access is OffSeq’s suggestion.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

IBM Maximo AI Service code injection: a remote attacker could run arbitrary code on the system: 1. The attacker reaches Maximo AI Service over the network → 2. The service does not properly control how code is generated → 3. The attacker's code runs on the system → 4. Data and service could be fully affectedCVE-2026-90920 · IBM Maximo AI Service code injection: a remote attacker could runarbitrary code on the systemAttackerYour systemThe attacker reaches Maximo AI Service over the network — The CVSS score says the attack can come over the network, with no privileges and no user interaction needed. 1The attackerreaches Maximo AIService over thenetworkThe service does not properly control how code is generated — The weakness type is CWE-94 (code injection). No source says which component is at fault or how the injection happens. 2The service doesnot properlycontrol how codeis generatedThe attacker's code runs on the system — According to the CVE record, a remote attacker could execute arbitrary code. 3The attacker'scode runs on thesystemData and service could be fully affected — CVSS rates the impact on confidentiality, integrity and availability all as High. 4Data and servicecould be fullyaffectedAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-90920-ibm-maximo-ai-code-injection · CC BY 4.0
IBM Maximo AI Service code injection: a remote attacker could run arbitrary code on the system: 1. The attacker reaches Maximo AI Service over the network → 2. The service does not properly control how code is generated → 3. The attacker's code runs on the system → 4. Data and service could be fully affectedCVE-2026-90920 · IBM Maximo AI Servicecode injection: a remote attacker couldrun arbitrary code on the systemThe attacker reaches Maximo AI Service over the network — The CVSS score says the attack can come over the network, with no privileges and no user interaction needed. 1AttackerThe attacker reaches Maximo AIService over the networkThe service does not properly control how code is generated — The weakness type is CWE-94 (code injection). No source says which component is at fault or how the injection happens. 2Your systemThe service does not properlycontrol how code is generatedThe attacker's code runs on the system — According to the CVE record, a remote attacker could execute arbitrary code. 3Your systemThe attacker's code runs on thesystemData and service could be fully affected — CVSS rates the impact on confidentiality, integrity and availability all as High. 4AttackerData and service could be fullyaffectedAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-90920-ibm-maximo-ai-code-injection
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    The attacker reaches Maximo AI Service over the network

    The CVSS score says the attack can come over the network, with no privileges and no user interaction needed.

    Defense: Until you upgrade, restrict who can reach the service (OffSeq's suggestion, not IBM's).

  2. Your system

    The service does not properly control how code is generated

    The weakness type is CWE-94 (code injection). No source says which component is at fault or how the injection happens.

    Defense: Upgrade to 9.1.19 or 9.2.3 or later (or the latest version).

  3. Your system

    The attacker's code runs on the system

    According to the CVE record, a remote attacker could execute arbitrary code.

    Defense: Upgrade to a fixed version.

  4. Attacker

    Data and service could be fully affected

    CVSS rates the impact on confidentiality, integrity and availability all as High.

Who is affected

VersionAffected?
9.1.0Affected (listed in the CVE record)
Other 9.1-line versions before 9.1.19Probably affected (our analysis; no source confirms it)
9.1.19 or laterFixed
9.2.0Affected (listed in the CVE record)
Other 9.2-line versions before 9.2.3Probably affected (our analysis; no source confirms it)
9.2.3 or laterFixed

The CVE record lists only 9.1.0 and 9.2.0, yet the fixed versions are 9.1.19 and 9.2.3. Our analysis is that “9.1.0” and “9.2.0” probably name release lines rather than single versions; no source says this directly.

Don’t confuse this with CVE-2026-90921: that is a separate flaw in the same product which, according to IBM, can terminate the host process through improper handling of malformed frames. It is a denial of service, not code execution.

How it works

The CVE record classifies the weakness as CWE-94, “Improper Control of Generation of Code”, commonly called code injection: when a program builds or runs code on the fly, outside input ends up shaping what gets executed, so an attacker can slip in their own instructions.

No source says which component is at fault or how the injection happens. All we know comes from the CVSS 3.1 score (9.8, Critical):

  • It can be launched over the network (AV:N), with low attack complexity (AC:L)
  • No privileges are needed (PR:N), and no user interaction (UI:N)
  • Impact on confidentiality, integrity and availability is High

OffSeq’s machine-generated analysis says the attack works without authentication; IBM’s description does not use that wording and only scores it as needing no privileges.

How this class of weakness typically looks (conceptual illustration, unrelated to Maximo’s actual code):

Show code example(python)
# Flawed approach: run outside input directly as code
result = eval(user_supplied_expression)

A safer approach:

Show code example(python)
# Only allow predefined operations; input can only "choose", never become code
ALLOWED = {"sum": compute_sum, "avg": compute_avg}
op = ALLOWED.get(user_choice)
if op is None:
    raise ValueError("not allowed")
result = op(data)

Timeline

DateEvent
2026-09-14CVE ID reserved
2026-09-24AI Service Component 9.1.19 released (release notes mention security fixes)
2026-09-24 (probable)9.2.3 released; the release notes say 2025-09-24, which we judge to be a typo for 2026
2026-09-289.2.3 release notes page last modified
2026-10-05IBM security bulletin node/7290833 first published, listing CVE-2026-90920 and the fixed versions (first disclosure)
2026-10-12CVE record published
2026-10-13Not listed in CISA KEV as of this date

Our analysis: the fixed releases appear to have come out before IBM’s bulletin and the CVE record. This is reasoning from dates; IBM’s bulletin lists these releases as fixes but does not give their release dates, and the release notes do not name this CVE.

Further reading

  • Scoring: the 9.8 score and vector come from the CVE record. When the snapshot was taken, NVD’s status was “Received”, meaning NVD had not analysed it yet; the GitHub Advisory Database entry GHSA-9m3p-9mhg-hf3c is also still “unreviewed”.
  • Vendor bulletin: the CVE record points to IBM security bulletin node/7290833 (first published 2026-10-05). Its title is about multiple CVEs in third-party dependencies, but it also lists CVE-2026-90920 with its description, CWE-94, CVSS 9.8, affected versions 9.1.0/9.2.0 and fixed versions 9.1.19/9.2.3.
  • Exploitation: not in CISA KEV as of 2026-10-13. OffSeq says no in-the-wild exploits are reported, but neither IBM nor any threat-intel source confirms this; whether it was exploited as a zero-day, or whether a public proof-of-concept exists, is unknown.
  • Related weakness type: CWE-94.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-13 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2026-90920 Record (Maximo AI Service Code Injection) · CVE Program (CNA: IBM), 2026-10-12 · accessed 2026-10-13
  2. AdvisorySecurity Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs · IBM, 2026-10-05 · accessed 2026-10-13
  3. CVE / NVD / OSVNVD - CVE-2026-90920 · NIST · accessed 2026-10-13
  4. Patch / releaseIBM Maximo Application Suite AI Service Component 9.1.19 release notes · IBM, 2026-09-24 · accessed 2026-10-13
  5. Patch / releaseIBM Maximo Application Suite AI Service Component 9.2.3 release notes · IBM · accessed 2026-10-13
  6. AdvisorySecurity Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs. (includes CVE-2026-90921) · IBM · accessed 2026-10-13
  7. OtherGitHub Advisory Database: GHSA-9m3p-9mhg-hf3c · GitHub · accessed 2026-10-13
  8. ResearchCVE-2026-90920: CWE-94 Code Injection in IBM Maximo AI Service · OffSeq Radar (machine-generated) · accessed 2026-10-13

Press brief

In one sentence

IBM Maximo AI Service is the AI service component of IBM Maximo Application Suite. CVE-2026-90920 is a code injection flaw first disclosed by IBM in a security bulletin on October 5, 2026; the CVE record was published on October 12. According to IBM's bulletin and the CVE record, a remote attacker could run arbitrary code on the affected versions 9.1.0 and 9.2.0, and it is scored CVSS 9.8; the listed fixed versions are 9.1.19 and 9.2.3 (or the latest). As of October 13, 2026, it was not in the US CISA Known Exploited Vulnerabilities catalog.

Key facts

Severity
CVSS 3.1 9.8 (Critical) cveawg.mitre.org
Affected versions
9.1.0, 9.2.0 cveawg.mitre.org
Fixed versions
9.1.19, 9.2.3 or the latest cveawg.mitre.org
9.1.19 released
2026-09-24 ibm.com
First disclosed (IBM security bulletin)
2026-10-05 ibm.com
CVE record published
2026-10-12 cveawg.mitre.org

Confirmed

  • IBM's security bulletin and the CVE record both say a remote attacker could run arbitrary code on Maximo AI Service 9.1.0 and 9.2.0; the weakness type is CWE-94.
  • IBM's security bulletin and the CVE record both list 9.1.19 and 9.2.3 (or the latest) as fixed versions and recommend upgrading; IBM's bulletin gives no workaround.
  • IBM security bulletin node/7290833 was first published on 2026-10-05, before the CVE record (2026-10-12).
  • As of 2026-10-13, it was not listed in CISA KEV.

Unconfirmed / disputed

  • Whether it has been exploited: only OffSeq says no in-the-wild exploits are reported, and neither IBM nor threat-intel sources confirm it; whether it was a zero-day, or whether a public proof-of-concept exists, is unknown.
  • OffSeq says the attack works without authentication; IBM's description does not say so and only scores it as needing no privileges.
  • No source names the vulnerable component or how the injection happens; the 9.1.19 and 9.2.3 release notes themselves do not name this CVE (the fixed-version mapping comes from IBM's security bulletin and the CVE record).

Quotable line

PlainCVE's reading of the dates: releases IBM lists as fixes for this CVE appear to have shipped before it was disclosed, and their release notes did not name it.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "IBM Maximo AI Service code injection: a remote attacker could run arbitrary code on the system". PlainCVE. https://plaincve.date/en/vulns/cve-2026-90920-ibm-maximo-ai-code-injection (accessed YYYY-MM-DD)
BibTeX
@misc{cve202690920ibmmaximoaicodeinjection2026,
  title  = {IBM Maximo AI Service code injection: a remote attacker could run arbitrary code on the system},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-90920-ibm-maximo-ai-code-injection},
  note   = {Updated 2026-10-13}
}