NVD Flags Critical CVE-2026-90920 in IBM Maximo AI Service 9.1.0, 9.2.0

IBM has disclosed a critical vulnerability in its Maximo AI Service software. The flaw affects specific versions and allows remote attackers to execute arbitrary code on affected systems.

What happened

The National Vulnerability Database has recorded CVE-2026-90920 as a critical security issue. This entry applies specifically to IBM Maximo AI Service version 9.1.0 and version 9.2.0. The vulnerability stems from improper control of code generation within these software releases.

According to the NVD record, a remote attacker can exploit this weakness. The attacker gains the ability to execute arbitrary code on the targeted system. The Common Weakness Enumeration categorizes this flaw as CWE-94, which relates to code injection issues.

The Common Vulnerability Scoring System assigns a base score of 9.8 to this issue. This high score reflects the severity of the potential impact. The rating indicates that the vulnerability is critical and requires immediate attention from security teams.

Why it matters

IBM Maximo is a widely used enterprise asset management platform. Organizations relying on the AI Service component for 9.1.0 or 9.2.0 are directly at risk. The ability to execute arbitrary code can lead to full system compromise.

Security teams must verify their current deployment versions immediately. Any instance running 9.1.0 or 9.2.0 is vulnerable to this specific attack vector. The critical CVSS score underscores the urgency of addressing this exposure.

No patch or fix has been confirmed yet in the available source material. Administrators should monitor official IBM channels for updates. Until a remediation is available, the risk remains active for all unpatched instances.

What to watch

• Check if your environment runs IBM Maximo AI Service 9.1.0 or 9.2.0
• Monitor IBM security advisories for patches related to CVE-2026-90920
• Review network logs for unusual code execution attempts on affected servers
• Ensure access controls are strictly enforced to limit potential attack surfaces

What to do and how to stay safe: IBM

• Identify all systems running IBM Maximo AI Service versions 9.1.0 and 9.2.0
• Isolate affected systems from critical networks if possible until a patch is available
• Review firewall rules to restrict unnecessary external access to the AI service
• Monitor system logs for signs of unauthorized code execution or anomalies

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which IBM products are affected by CVE-2026-90920?

IBM Maximo AI Service versions 9.1.0 and 9.2.0 are the only affected products listed in the source material.

What is the CVSS score for this vulnerability?

The NVD rates CVE-2026-90920 with a CVSS score of 9.8, which is classified as critical.

Is there a patch available for this flaw?

The source material does not mention a confirmed patch or fix for CVE-2026-90920.