Maximo AI Service CVE-2026-78673

Exploitation requires network reachability to the IBM Maximo AI Service API/interface (versions 9.1.0 and 9.2.0); per AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special configuration is stated as required, so default network-exposed deployments are at risk. The description does not name the specific vulnerable feature, endpoint, parameter, or input format that triggers the improper input validation, so the concrete trigger could not be extracted from available data. The principal limiting factor is exposure scope: impact is confined to availability (service disruption) with no data compromise, and risk is materially reduced where the AI Service is not exposed beyond trusted internal networks.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw whose sole impact is availability (C:N/I:N), consistent with a denial-of-service condition from improper input validation (CWE-20). All signals agree on 'high severity by score, availability-only impact' - there is no confidentiality or integrity exposure and no code execution implied. However, the real-world priority signals are largely MISSING: no EPSS probability was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced. With no exploitation-probability or active-exploitation data, this reads as a high-CVSS issue whose true urgency cannot be elevated above 'patch in normal cycle' from the data alone. The single reference is an IBM support page (node/7290473) reported by IBM PSIRT; exact triggering input and whether exploitation requires reachable/authenticated API endpoints is NOT detailed in the available description - verify affected deployment exposure with IBM's advisory.

A remote attacker with network access to the IBM Maximo AI Service endpoint sends malformed or malicious input that the service fails to validate properly, causing the service to crash or become unresponsive and denying asset-management functionality to legitimate users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this can be triggered over the network, at low complexity, without authentication or user interaction. No public exploit code is identified at time of analysis.