CVE-2026-90920 is a critical (CVSS 9.8) code injection flaw in IBM Maximo AI Service 9.1.0 and 9.2.0 that could let a remote attacker execute arbitrary code.
What Is It
The NVD record says IBM Maximo AI Service 9.1.0 and 9.2.0 "could allow a remote attacker to execute arbitrary code due to improper control of code generation." The weakness is CWE-94, Improper Control of Generation of Code ("Code Injection").
IBM's PSIRT ([email protected]) reported the vulnerability. It was published to NVD on 2026-10-12 and has the status "Received," which means NVD has not finished its own analysis yet.
Why It Matters
IBM's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (CRITICAL). In plain terms:
- Attack vector: It can be attacked over the network.
- Complexity: Attack complexity is low.
- Access needed: The attacker needs no privileges and no user interaction.
- Impact: Confidentiality, integrity and availability are all rated high.
An attacker who can reach a vulnerable instance could run arbitrary code on it without logging in. That combination is why the score is near the top of the scale.
Exploitation status: CVE-2026-90920 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has not been confirmed in the material we reviewed. CISA has not issued a required action or due date for this CVE.
What's Vulnerable
IBM's affected-product data lists:
| Vendor | Product | Affected Versions |
|---|---|---|
| IBM | Maximo AI Service | 9.1.0 |
| IBM | Maximo AI Service | 9.2.0 |
Affected CPEs:
cpe:2.3:a:ibm:maximo_ai_service:9.1.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:maximo_ai_service:9.2.0:*:*:*:*:*:*:*
Patch Status
The NVD record does not name fixed versions or describe remediation. It links to one IBM support page, which is IBM's vendor advisory for this issue.
Organizations running Maximo AI Service 9.1.0 or 9.2.0 should:
- Read the IBM advisory for fixed releases, workarounds and mitigations.
- Patch quickly, given the network-reachable, no-authentication, critical-severity profile.