What happened
Published 2026-10-12 (CVSS 9.8, CWE-94) by IBM PSIRT. Sibling advisories cover DoS (CVE-2026-78673, CVE-2026-90911, CVE-2026-90912, CVE-2026-90921). Verified via NVD REST API.
Why it matters
An unauthenticated remote code-execution in an enterprise AI service is a direct compromise of the AI workload, and automatable exploitation makes it a priority for any Maximo AI Service operator.
Attack vector
Improper control of code generation (CWE-94) in Maximo AI Service 9.1.0/9.2.0: remote attacker triggers execution of arbitrary code through a code-generation path.
Affected systems
IBM Maximo AI Service 9.1.0 and 9.2.0
Mitigation
Apply the IBM fix in security bulletin node/7290833 (9.1.0/9.2.0 remediation).