IBM Maximo AI Service CVE-2026-90911

Exploitation requires network reachability to the IBM Maximo AI Service (versions 9.1.0 or 9.2.0) interface; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is stated as necessary, making default internet- or network-exposed deployments the primary at-risk population. The chief limiting factor is network exposure: the impact is confined to availability (C:N/I:N) with no data compromise or code execution, so the realistic risk is service downtime rather than breach, and organizations that restrict the service to internal/segmented networks substantially reduce exposure. Applying the vendor patch is the definitive mitigation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw whose sole impact is availability - consistent with the CWE-400 uncontrolled-resource-consumption denial-of-service described by the vendor. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 7.5 rating is driven entirely by ease of reach and full availability loss, not by confidentiality or integrity impact. This places it as a moderate operational-availability concern rather than a top-tier emergency: easy to trigger remotely if reachable, but it cannot compromise data or gain code execution, and exploitation requires network exposure of the Maximo AI Service endpoint. Missing signals to note explicitly: EPSS probability is absent (cannot gauge likelihood of mass exploitation), and the description does not specify the exact resource exhausted (CPU, memory, threads, connections) or whether a specific request type triggers it - verify the precise trigger with IBM advisory node/7290473.

A remote attacker with network access to the Maximo AI Service interface sends crafted or high-volume requests that the service processes without resource limits, exhausting CPU, memory, or connection capacity and rendering the asset-management service unavailable to legitimate users. No authentication or user interaction is required per the CVSS vector. No public proof-of-concept was provided in the intelligence sources.