Do Son 
TL;DR
IBM published fixes for three IBM critical vulnerabilities rated between CVSS 9.8 and 9.9. The flaws hit IBM i, Db2 Mirror for i and Maximo AI Service. One of them allows remote code execution without any login.
- Product: IBM (3 products)
- Vulnerabilities: 3 flaws (CVE-2026-96119, CVE-2026-96012, CVE-2026-90920)
- Highest severity: 9.9 (Critical · CVSSv3)
- Worst impact: BM s Affected By An mproper Control of Code Generaton Vulnerablty n HTTP Server Admnstraton GU
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-96119 | 9.9 | CWE-94 | Not exploited |
| CVE-2026-96012 | 9.9 | CWE-264 | Not exploited |
| CVE-2026-90920 | 9.8 | CWE-94 | Not exploited |
Why It Matters
IBM i and Maximo run core business systems in banking, manufacturing and utilities. A single compromised server can therefore expose critical data and operations. For all three bulletins, IBM gives the same advice: “IBM strongly recommends addressing the vulnerability now.”
How the Attacks Work
CVE-2026-90920: Maximo AI Service (CVSS 9.8)
This is the most urgent of the three. It stems from improper control of code generation. A remote attacker needs no credentials to run arbitrary code on the service. The Maximo AI Service security bulletin also updates bundled components, including Apache Tomcat, Netty and glibc.
CVE-2026-96119: IBM i HTTP Server Administration (CVSS 9.9)
This code injection flaw sits in the HTTP Server Administration GUI. A remote authenticated attacker could steal data or execute arbitrary code. Details appear in the IBM i HTTP Server Administration bulletin.
CVE-2026-96012: Db2 Mirror for i (CVSS 9.9)
Here, an authenticated attacker can send a crafted request that skips extra authorization and input checks. As a result, they could run malicious code and gain elevated privileges. IBM covers the fix in its Db2 Mirror for i bulletin.
Exploitation status
IBM does not report exploitation in the wild for these IBM critical vulnerabilities. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
- Maximo AI Service: 9.1.0 and 9.2.0
- IBM i: 7.3, 7.4, 7.5 and 7.6
- Db2 Mirror for i: 7.4, 7.5 and 7.6
Patch and Mitigation Steps
IBM lists no workarounds, so patching is the only fix.
- Maximo AI Service: upgrade to 9.1.19 or 9.2.3, or the latest catalog release.
- IBM i: apply PTF SJ11641 (7.3), SJ11643 (7.4), SJ11644 (7.5) or SJ11645 (7.6).
- Db2 Mirror for i: apply PTF SJ11623 (7.4), SJ11624 (7.5) or SJ11625 (7.6).
Admins should also restrict network access to the IBM i administration GUI and to Maximo AI Service endpoints. Patch the unauthenticated Maximo flaw first, since it carries the lowest barrier to remote code execution.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
