# CVE-2026-90921: IBM Maximo AI Service denial of service in frame handling

Source: https://junglewise.ai/threats/cve-2026-90921-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-90921 · Severity: high · CVSS 7.5 · Published 2026-10-12

IBM Maximo AI Service is an AI platform that processes and analyzes data for enterprise applications. A remote attacker can send specially crafted network frames that cause the service to terminate unexpectedly, resulting in service disruption and potential data processing outages. The vulnerability requires no authentication and can be triggered over the network without user interaction.

Technologies: [IBM Maximo AI Service](https://junglewise.ai/threats/technologies/maximo-ai-service). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-90921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90921 being exploited in the wild.

**How severe is CVE-2026-90921?** High severity, with a CVSS score of 7.5, published 12 October 2026.

**Which products and versions are affected?** IBM Maximo AI Service 9.1.0, 9.2.0.

**Is there a fix for CVE-2026-90921?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90921 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-90921?** Check whether you run IBM Maximo AI Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper handling of malformed frames in Maximo AI Service versions 9.1.0 and 9.2.0, leading to denial of service through host process termination. Attack is network-based with no authentication or user interaction required. The flaw allows remote attackers to crash the service by sending malformed network frames that bypass input validation.

## Affected products

- IBM Maximo AI Service 9.1.0, 9.2.0

## Timeline

- 2026-10-12: disclosed

## References

- [https://www.ibm.com/support/pages/node/7290473](https://www.ibm.com/support/pages/node/7290473)

## Related threats

- [IBM Maximo AI Service code generation remote code execution](https://junglewise.ai/threats/cve-2026-90920-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote)
- [IBM Maximo AI Service denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-90912-ibm-maximo-ai-service-9-1-0-and-9-2-0-saas-could-allow-a-remote)
- [IBM Maximo AI Service uncontrolled resource consumption DoS](https://junglewise.ai/threats/cve-2026-90911-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote)
- [IBM Maximo AI Service input validation denial of service](https://junglewise.ai/threats/cve-2026-78673-ibm-maximo-ai-service-9-1-0-and-9-2-0-could-allow-a-remote)