IBM Maximo AI Service 9.1 and 9.2: unauthenticated code-injection flaw CVE-2026-90920 rated CVSS 9.8, fixed in 9.1.19 and 9.2.3 alongside Tomcat, Netty and glibc component updates

IBM security bulletin 7290833 (initial publication 5 October 2026) covers Maximo AI Service 9.1.0 and 9.2.0, the AI component of the Maximo Application Suite used for asset and maintenance management. Its most serious item is IBM's own CVE-2026-90920: improper control of code generation (CWE-94) that IBM says could let a remote attacker execute arbitrary code. IBM rates it CVSS 3.1 9.8 with no privileges or user interaction needed. The CVE record was published on 13 October 2026 (Perth time). The same bulletin fixes vulnerable third-party parts bundled with the service: Apache Tomcat embed core 10.1.57 (including the security-constraint and DIGEST authentication bypasses CVE-2026-65182 and CVE-2026-65905), Netty handler (CVE-2026-75595 SNI mutual-TLS bypass), Apache HttpClient 5 (CVE-2026-71290 hostname verification), GitPython and glibc. IBM lists no workarounds and says to upgrade now. Three further Maximo AI Service denial-of-service CVEs published at the same time (CVE-2026-90911, -90912 and -90921, CVSS 7.5) point to IBM bulletin 7290473 (1 October 2026), which is fixed by the same releases. No exploitation or public exploit has been reported, and the CVE is not on CISA's KEV list. Primary: IBM security bulletin; CVE record (IBM CNA).

Product

IBM Maximo AI Service (Maximo Application Suite)

Versions

Affected: 9.1.0 and 9.2.0. Fixed: 9.1.19 or later, 9.2.3 or later (from the Catalog under Update Available).

CVSS

9.8 (IBM, CVSS 3.1) for CVE-2026-90920

Exploited in Australia?

unknown

Patch to

Upgrade Maximo AI Service to 9.1.19 or 9.2.3 (or later). IBM gives no workaround. Until upgraded, keep the service off the internet and reachable only from the Maximo cluster and admin networks, and review its logs for unexpected code execution.

Primary: IBM Security Bulletin 7290833 — Maximo AI Service third-party dependencies and CVE-2026-90920 (initial publication 5 Oct 2026) · Vendor: CVE record CVE-2026-90920 (assigner: IBM) — Maximo AI Service code injection, CVSS 9.8 · CVE: CVE-2026-90920, CVE-2026-65182, CVE-2026-65905, CVE-2026-75595, CVE-2026-71290, CVE-2026-90911 · IBM Security Bulletin 7290473 — Maximo AI Service third-party dependencies (1 Oct 2026; CVE records CVE-2026-90911, -90912, -90921 point here)

vulnerabilities