CVE-2026-90912: IBM Maximo AI Service DOS Vulnerability

CVE-2026-90912 Overview

CVE-2026-90912 is a denial of service vulnerability affecting IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS deployments. The flaw stems from uncontrolled recursion [CWE-674], which a remote attacker can trigger over the network without authentication or user interaction. Successful exploitation exhausts service resources and renders the AI service unavailable to legitimate users. The vulnerability affects availability only; confidentiality and integrity remain intact.

Critical Impact
Unauthenticated remote attackers can disrupt IBM Maximo AI Service availability by sending crafted input that triggers unbounded recursive processing.

Affected Products

IBM Maximo AI Service 9.1.0 (SaaS)
IBM Maximo AI Service 9.2.0 (SaaS)

Discovery Timeline

2026-10-12 - CVE-2026-90912 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-90912

Vulnerability Analysis

The vulnerability resides in a code path within IBM Maximo AI Service that processes recursive data structures or nested input without enforcing depth limits. When the service receives specially crafted input, the recursive function continues to call itself until the process consumes available stack or memory resources. This produces a stack overflow, thread exhaustion, or out-of-memory condition that terminates the handling process.

Because the attack vector is network-based and requires no privileges or user interaction, any client that can reach the Maximo AI Service endpoint can trigger the condition. The scope is unchanged, meaning the impact is contained to the vulnerable service. Repeated requests can sustain the denial of service and prevent recovery without intervention.

Root Cause

The root cause is uncontrolled recursion, classified under [CWE-674]. The affected code lacks a recursion depth guard or input size validation before entering the recursive path. Developers typically prevent this class of flaw by capping recursion depth, converting recursive logic to iterative processing, or validating structural complexity of inbound data before parsing.

Attack Vector

An attacker sends a crafted request to a reachable IBM Maximo AI Service endpoint. The payload contains deeply nested or self-referential structures that force the service to recurse beyond safe limits. The service process consumes stack frames or heap allocations until it crashes or becomes unresponsive. No authentication, prior access, or victim interaction is required.

Technical details and payload specifics have not been published. Refer to the IBM Support Page for vendor-provided information.

Detection Methods for CVE-2026-90912

Indicators of Compromise

Repeated service crashes, restarts, or unresponsive states in IBM Maximo AI Service logs correlated with inbound requests.
Spikes in CPU, memory, or stack usage on Maximo AI Service hosts followed by process termination.
Unusually large or deeply nested payloads in HTTP request bodies destined for the AI service.

Detection Strategies

Enable verbose application logging on the Maximo AI Service to capture stack traces indicating recursion limits or StackOverflowError conditions.
Monitor API gateways and reverse proxies for anomalous request sizes and structural complexity targeting Maximo endpoints.
Correlate availability alerts from service health checks with request-source IP addresses to identify repeat offenders.

Monitoring Recommendations

Deploy runtime telemetry that tracks process restart frequency, thread counts, and memory saturation for Maximo AI Service workloads.
Alert on sustained HTTP 5xx responses from Maximo AI Service endpoints combined with resource exhaustion metrics.
Ingest Maximo application and infrastructure logs into a centralized SIEM for cross-source correlation and historical analysis.

How to Mitigate CVE-2026-90912

Immediate Actions Required

Apply the fix referenced in the IBM Support Page as soon as it is available for your SaaS tenant.
Restrict network exposure of Maximo AI Service endpoints to trusted clients and internal networks where feasible.
Enable rate limiting and request size caps at upstream API gateways or web application firewalls.

Patch Information

IBM has published remediation guidance for IBM Maximo AI Service 9.1.0 and 9.2.0 at the IBM Support Page. SaaS customers should confirm the deployed service version aligns with the fixed release identified by IBM.

Workarounds

Enforce maximum request body size and JSON/XML nesting depth at the WAF or API gateway layer to block malformed recursive payloads.
Apply strict allowlists for client IPs permitted to call Maximo AI Service endpoints until the patch is confirmed deployed.
Configure process supervisors to automatically restart the AI service and alert operators when crashes occur.

bash

# Example: limit request body size and nesting at an NGINX reverse proxy
client_max_body_size 1m;
large_client_header_buffers 4 8k;
limit_req_zone $binary_remote_addr zone=maximo:10m rate=10r/s;

location /maximo-ai/ {
    limit_req zone=maximo burst=20 nodelay;
    proxy_pass https://maximo-ai-backend;
}