CVE-2026-90911 in Maximo AI Service
Summary
by MITRE • 10/13/2026
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in IBM Maximo AI Service versions 9.1.0 and 9.2.0 represents a significant risk related to the handling of external inputs within the application's processing logic. This flaw is categorized under CWE-400, which describes conditions where an entity does not properly control the allocation or maintenance of a limited resource, leading to uncontrolled resource consumption. In this specific context, the vulnerability allows a remote attacker to trigger actions that consume excessive system resources such as CPU cycles, memory, or network bandwidth without requiring authentication in some configurations or by exploiting insufficient validation mechanisms on authenticated requests. The core technical flaw lies in the absence of robust rate limiting, input size constraints, or computational complexity checks when processing certain API calls or data inputs directed at the AI service components.
From an operational perspective, this vulnerability can be exploited to launch denial-of-service attacks against the IBM Maximo environment. By sending specially crafted requests that force the application into resource-intensive operations, an attacker can degrade the performance of the entire system for legitimate users. This degradation may manifest as increased latency, timeouts, or complete unavailability of critical business functions managed by Maximo. Since AI services often involve complex computations such as natural language processing or image recognition, improper handling of large or malformed inputs can lead to exponential resource usage, amplifying the impact of a relatively small number of malicious requests. The availability of this vulnerability poses a direct threat to the reliability and continuity of operations for organizations relying on IBM Maximo for asset management and operational workflows.
The exploitation of this flaw aligns with ATT&CK technique T1496, which involves resource hijacking or denial of service through environmental degradation. Attackers can leverage this weakness as part of a broader campaign to disrupt business operations or create distractions while attempting other malicious activities such as data exfiltration or lateral movement within the network. The lack of adequate safeguards against unbounded input processing means that even low-privileged users, if they have access to specific endpoints, could potentially contribute to system instability. This underscores the importance of implementing defense-in-depth strategies rather than relying solely on perimeter security measures.
To mitigate this vulnerability, organizations should immediately apply the latest patches and updates provided by IBM for Maximo AI Service versions 9.1.0 and 9.2.0. These updates typically include code changes that enforce stricter input validation, implement rate limiting mechanisms, and optimize resource allocation algorithms to prevent excessive consumption. Additionally, administrators should configure web application firewalls or API gateways to monitor and restrict the volume of requests directed at AI service endpoints. Implementing network-level controls such as traffic shaping and connection limits can further reduce the impact of potential abuse. Regular security assessments and penetration testing focused on input validation and resource management are recommended to identify similar weaknesses in other components of the Maximo ecosystem, ensuring a more resilient infrastructure against denial-of-service threats.