# CVE-2026-78673: IBM Maximo AI Service input validation denial of service

Source: https://junglewise.ai/threats/cve-2026-78673-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-78673 · Severity: high · CVSS 7.5 · Published 2026-10-12

IBM Maximo AI Service is an artificial intelligence platform for enterprise asset management. A remote attacker can send specially crafted input to the service, causing it to crash and become unavailable to legitimate users. The vulnerability does not require authentication and can be triggered over the network.

Technologies: [IBM Maximo AI Service](https://junglewise.ai/threats/technologies/maximo-ai-service). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-78673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78673 being exploited in the wild.

**How severe is CVE-2026-78673?** High severity, with a CVSS score of 7.5, published 12 October 2026.

**Which products and versions are affected?** IBM Maximo AI Service 9.1.0, 9.2.0.

**Is there a fix for CVE-2026-78673?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78673 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-78673?** Check whether you run IBM Maximo AI Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in Maximo AI Service versions 9.1.0 and 9.2.0 due to improper input validation (CWE-20). An unauthenticated remote attacker can trigger the vulnerability over the network without user interaction. The flaw causes the application to consume resources or crash, rendering the service unavailable.

## Affected products

- IBM Maximo AI Service 9.1.0, 9.2.0

## Timeline

- 2026-10-12: disclosed

## References

- [https://www.ibm.com/support/pages/node/7290473](https://www.ibm.com/support/pages/node/7290473)

## Related threats

- [IBM Maximo AI Service denial of service in frame handling](https://junglewise.ai/threats/cve-2026-90921-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote)
- [IBM Maximo AI Service code generation remote code execution](https://junglewise.ai/threats/cve-2026-90920-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote)
- [IBM Maximo AI Service denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-90912-ibm-maximo-ai-service-9-1-0-and-9-2-0-saas-could-allow-a-remote)
- [IBM Maximo AI Service uncontrolled resource consumption DoS](https://junglewise.ai/threats/cve-2026-90911-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote)