IBM has issued patches for three critical vulnerabilities across IBM i, Db2 Mirror for i and Maximo AI Service, with CVSS scores up to 9.9. The flaws allow remote code execution or data access and affect Maximo AI Service (versions 9.1.0 and 9.2.0), IBM i (versions 7.3–7.6) and Db2 Mirror for i (7.4–7.6). The highest-risk issue is CVE-2026-90920 in Maximo AI Service, which enables remote code execution over the unauthenticated Maximo endpoint.
IBM notes that this bulletin also updates bundled components such as Apache Tomcat, Netty and glibc. Two other critical flaws—CVE-2026-96119 in IBM i HTTP Server Administration (9.9) and CVE-2026-96012 in Db2 Mirror for i (9.9)—could allow an authenticated attacker to run arbitrary code or gain elevated privileges after sending crafted requests or via code injection in the HTTP server GUI.
Exploitation in the wild has not been reported for these vulnerabilities, and no public proof-of-concept has been confirmed. IBM provides patch guidance via product advisories, with no workarounds available. Recommended mitigations include upgrading Maximo AI Service to 9.1.19 or 9.2.3 (or latest catalog release), and applying the corresponding PTFs: SJ11641/SJ11643/SJ11644/SJ11645 for IBM i depending on the release, and SJ11623/SJ11624/SJ11625 for Db2 Mirror for i.
Administrators should also restrict network access to the IBM i administration GUI and to Maximo AI Service endpoints, prioritising the unauthenticated Maximo flaw for patching.