{"id":"CVE-2026-90920","published":"2026-10-12T22:17:05.683","lastModified":"2026-10-13T16:17:14.080","description":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7290833","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Maximo AI Service allows remote attackers to execute arbitrary code due to improper code generation controls, potentially leading to full system compromise.","exploitability":"Exploitation appears straightforward for remote attackers with no authentication required, leveraging the improper code generation controls to inject and execute malicious code.","blast_radius":"If exploited, this vulnerability could allow attackers to gain complete control over the Maximo AI Service environment, potentially affecting enterprise asset management workflows and data integrity.","remediation":"Upgrade to IBM Maximo AI Service 9.2.1 or later to address this arbitrary code execution vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","enterprise","ai"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:47:41.386Z"}}