IBM published three critical security bulletins covering IBM i, Db2 Mirror for i and Maximo AI Service, with severity scores between CVSS 9.8 and 9.9. IBM says no workarounds exist and has not reported exploitation or public proof-of-concept code.
Maximo AI Service Flaw Allows Unauthenticated Remote Code Execution
The most urgent of the three bulletins concerns Maximo AI Service. Improper control of code generation allows a remote, unauthenticated attacker to run arbitrary code. Because the attacker needs no credentials, this flaw ranks first for patching.
The same bulletin also updates bundled components, including Apache Tomcat, Netty and glibc. Applying it therefore changes more than the AI service itself, and teams scheduling the update should expect those libraries to change alongside the vulnerable code.
IBM i HTTP Server Administration GUI Code Injection
A second bulletin covers the IBM i HTTP Server Administration GUI, where a remote attacker with authentication can inject code. Successful exploitation could result in data theft or code execution on the system.
The authentication requirement narrows who can exploit the flaw, but IBM i runs core systems in banking, manufacturing and utilities, so any account that can reach the administration interface is worth protecting.
Db2 Mirror for i Request Skips Authorization and Input Checks
The third bulletin addresses Db2 Mirror for i. An authenticated attacker can send a crafted request that bypasses authorization and input validation checks. The result is code execution and privilege escalation. IBM’s description combines two failures in a single request: the authorization check and the input check are both skipped.
The scores for the three bulletins run from 9.8 to 9.9, near the top of the CVSS scale. IBM’s wording leaves little room for deferral. It recommends addressing the vulnerabilities now and offers no interim workaround for any of them.
Taken together, the two authenticated flaws on IBM i components offer an attacker with a foothold a route to higher privileges, while the Maximo flaw requires no foothold at all.
IBM Urges Immediate Patching With No Workarounds
IBM says it “strongly recommends addressing the vulnerability now.” The company lists no workarounds for any of the three issues, so applying the fixes is the only complete remedy. IBM has not reported exploitation or public proof-of-concept code for any of them.
The bulletins were published on October 12 and 13. The source article for this report does not provide the CVE identifiers, so readers should consult IBM’s bulletins directly for tracking numbers and affected version ranges.
Banking, Manufacturing and Utilities Run on IBM i and Maximo
IBM i and Maximo underpin core systems in banking, manufacturing and utilities. IBM did not list CVE identifiers in the source reporting, so affected installations should be identified from the bulletins themselves. A compromise in either environment can reach core business systems rather than only office IT.
Patching Maximo AI Service First and Restricting IBM i Admin GUI Access
The response guidance that accompanies the bulletins has three parts. First, apply the patches, starting with the unauthenticated Maximo AI Service flaw. Second, restrict network access to the IBM i administration GUI. Third, restrict access to Maximo AI Service endpoints.
The network restrictions matter more because IBM offers no workaround: limiting who can reach the vulnerable interfaces is the only way to reduce exposure for systems that cannot be patched immediately. The two authenticated flaws also depend on valid credentials, so limiting administrative interface access narrows the number of people and addresses that can attempt exploitation.
All of the information in this report comes from a single source covering the bulletins, so organizations should check IBM’s own security bulletins for the definitive version lists before scheduling updates.
