CVE-2026-90911: IBM Maximo AI Service DoS Vulnerability

CVE-2026-90911 Overview

CVE-2026-90911 is a denial of service vulnerability affecting IBM Maximo AI Service versions 9.1.0 and 9.2.0. The flaw stems from uncontrolled resource consumption [CWE-400] and allows a remote, unauthenticated attacker to disrupt service availability over the network. Exploitation requires no privileges and no user interaction, making the attack surface broad for internet-exposed deployments. The vulnerability affects availability only; confidentiality and integrity of data remain intact.

Critical Impact
Remote attackers can exhaust system resources on IBM Maximo AI Service, rendering the asset management AI capabilities unavailable to legitimate users without authentication.

Affected Products

IBM Maximo AI Service 9.1.0
IBM Maximo AI Service 9.2.0

Discovery Timeline

2026-10-12 - CVE CVE-2026-90911 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-90911

Vulnerability Analysis

The vulnerability resides in how IBM Maximo AI Service processes incoming requests. The service fails to bound the resources consumed when handling specific network inputs. An attacker can submit crafted requests that cause the service to allocate excessive memory, CPU cycles, or other finite resources. Sustained exploitation leads to service degradation or complete unavailability for legitimate users.

IBM Maximo AI Service is an enterprise asset management AI offering, so an outage directly impacts maintenance workflows, predictive insights, and operational tooling that depend on it. The attack vector is network-based, which exposes any instance reachable from untrusted networks.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400]. The application does not enforce limits on resource allocation during request processing. Without quotas, timeouts, or rate limiting at the application layer, repeated or oversized inputs can monopolize server capacity.

Attack Vector

Exploitation occurs over the network against the Maximo AI Service endpoint. The attacker does not need credentials or user interaction. By repeatedly issuing requests that trigger disproportionate backend work, the attacker drives the service into a resource-exhausted state. See the IBM Support Page for vendor-specific technical details.

Detection Methods for CVE-2026-90911

Indicators of Compromise

Sudden spikes in CPU, memory, or thread utilization on Maximo AI Service hosts without corresponding business workload increases.
High volume of inbound requests from a single source or small set of sources targeting Maximo AI Service endpoints.
Application logs showing request timeouts, out-of-memory errors, or thread pool exhaustion.

Detection Strategies

Baseline normal request patterns and alert on statistical deviations in request rate, payload size, or processing duration.
Correlate application performance telemetry with network flow data to identify abusive clients.
Monitor Maximo AI Service health endpoints and alert on repeated failed health checks or restart loops.

Monitoring Recommendations

Forward Maximo AI Service application logs and host metrics to a centralized analytics platform for continuous review.
Track resource utilization trends over rolling windows to catch gradual exhaustion attacks.
Enable network-layer flow monitoring on segments hosting Maximo components to identify volumetric anomalies.

How to Mitigate CVE-2026-90911

Immediate Actions Required

Apply the IBM-published fix referenced in the IBM Support Page for Maximo AI Service 9.1.0 and 9.2.0.
Restrict network access to Maximo AI Service endpoints so only trusted application tiers and users can reach them.
Deploy rate limiting and request size limits at a reverse proxy or web application firewall in front of the service.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators running Maximo AI Service 9.1.0 or 9.2.0 should review the advisory and apply the vendor-supplied fix according to IBM's documented upgrade procedure.

Workarounds

Place Maximo AI Service behind a reverse proxy enforcing per-client connection and request-rate limits.
Restrict exposure to internal networks or VPN-only access until the patch is deployed.
Configure application server thread pools, timeouts, and memory limits conservatively to contain resource exhaustion attempts.

bash

# Example nginx rate-limiting configuration in front of Maximo AI Service
http {
    limit_req_zone $binary_remote_addr zone=maximo:10m rate=10r/s;
    limit_conn_zone $binary_remote_addr zone=maximo_conn:10m;

    server {
        listen 443 ssl;
        server_name maximo.example.com;

        location / {
            limit_req zone=maximo burst=20 nodelay;
            limit_conn maximo_conn 10;
            client_max_body_size 1m;
            proxy_read_timeout 30s;
            proxy_pass http://maximo_ai_backend;
        }
    }
}