CVE-2026-90912

Received Received - Intake

IBM Maximo AI Service Denial of Service via Uncontrolled Recursion

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-90912

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Maximo	AI Service 9.1.0
IBM	Maximo	AI Service 9.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS is vulnerable to a denial of service attack due to uncontrolled recursion. This means an attacker could send specially crafted requests that cause the system to repeatedly call itself without proper limits, eventually exhausting system resources and making the service unavailable.

Detection Guidance

Detection of this vulnerability requires monitoring for signs of uncontrolled recursion or denial of service in IBM Maximo AI Service 9.1.0 or 9.2.0. Check application logs for excessive recursive calls or resource exhaustion. Use network monitoring tools to detect unusual traffic patterns targeting the service.

Impact Analysis

This vulnerability could allow an attacker to disrupt the availability of IBM Maximo AI Service. If exploited, it may cause the service to become slow or completely unresponsive, affecting users who rely on it for AI-related functions in their operations.

Compliance Impact

The vulnerability causes a denial of service due to uncontrolled recursion, which could disrupt system availability. This may impact compliance with standards like GDPR (availability principle) and HIPAA (accessibility requirements) by potentially leading to service unavailability.

Mitigation Strategies

Apply IBM-provided patches or updates for IBM Maximo AI Service 9.1.0 and 9.2.0 to address the uncontrolled recursion issue. Monitor network traffic for unusual patterns that may indicate a denial of service attempt.

Hi! I’m here to help you understand CVE-2026-90912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70