External risk intelligence

IBM Maximo Improper Control of Code Generation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-90920

IBM Maximo is an enterprise asset management platform typically deployed as a centralized web-based application. Such platforms often involve internet-facing interfaces or web-accessible services to facilitate remote access for organizational users, making them a plausible target for internet-based interaction in many enterprise deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects IBM Maximo AI Service, potentially allowing unauthorized remote code execution. The exposure of this service could introduce significant risks if not properly managed, emphasizing the need to verify its presence and security posture within our environment.

Uncontrolled code generation can lead to remote code execution.
Leadership should remember this for enterprise asset management security.
Confirm relevance and exposure of AI Service within our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the IBM Maximo AI Service over the network. Because the service improperly controls code generation, this could allow the attacker to execute arbitrary commands on the affected system.

Requires network access.
Triggers via improper code generation control.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

IBM Maximo AI Service, when improperly controlled, could enable a remote attacker to execute arbitrary code. This could impact system data, user data, and service behavior, depending on the specific configuration and environment.

System and user data could be at risk.
Exposure could occur via a network-based attack.
Arbitrary code execution could impact operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this vulnerability, identify all instances of IBM Maximo AI Service, determine their network exposure and business criticality, and then engage the appropriate application or platform owner to prioritize and plan remediation. Coordinating with vendor management may be necessary if the affected service is part of a third-party integration or managed offering.

Application and platform teams own the issue.
Verify network reachability and business criticality.
Plan risk-based remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Maximo AI Service?

IBM Maximo AI Service is a component within the IBM Maximo enterprise asset management platform. It leverages artificial intelligence to help organizations track, maintain, and optimize their physical assets—such as machinery, facilities, and equipment—by analyzing operational data to predict maintenance needs and improve performance.

What does CWE-94 mean in the context of CVE-2026-90920?

CWE-94 refers to improper control of code generation. In this vulnerability, the system incorrectly processes data or requests in a way that allows an attacker to inject or trigger the execution of unintended commands. This effectively tricks the software into running unauthorized instructions as if they were part of its legitimate operations.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted network request to the AI Service. The vulnerability relies on the service accepting these inputs without proper validation or constraint. Simply accessing the service's interface legitimately will not trigger the bug; the request must be maliciously structured to exploit the flaw in how code is generated or handled.

Is my system at risk if it uses IBM Maximo AI Service?

Your risk level depends on how your deployment is configured. According to Halo Surface Signal, IBM Maximo is a centralized platform often deployed with web-accessible interfaces for remote organizational use. If your instance is reachable over the network, it is a more plausible target for remote exploitation than a strictly internal, air-gapped system.

What should I do first to manage CVE-2026-90920?

Begin by auditing your infrastructure to locate every instance of the IBM Maximo AI Service. Once identified, document which systems are reachable over your network and assess their business importance. Use this information to coordinate with the platform owners or IT teams to prioritize the application of vendor-provided updates or security configurations.

References

www.ibm.com/support/pages/node/7290833

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.