CVE-2026-13476

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13476", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-06-27T02:18:22.491Z", "datePublished": "2026-08-12T20:58:16.282Z", "dateUpdated": "2026-08-14T22:16:24.859Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-12T21:01:16.803Z"}, "title": "IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Informix Dynamic Server", "versions": [{"status": "affected", "version": "14.10"}, {"status": "affected", "version": "15.0"}, {"status": "affected", "version": "12.10"}], "cpes": ["cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:14.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7282827", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on IBM Fix Central under the Informix Server section.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on\u00a0<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?function=all&amp;parent=ibm~Information%20Management&amp;platform=All&amp;product=ibm%2FInformation%20Management%2FInformix&amp;release=All&amp;mhsrc=ibmsearch_a&amp;mhq=Informix\" rel=\"noopener noreferrer nofollow\">IBM Fix Central under the Informix Server section</a>.</p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T22:16:14.270959Z", "id": "CVE-2026-13476", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T22:16:24.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13476", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T22:16:14.270959Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T22:16:20.933Z"}}], "cna": {"title": "IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:14.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Informix Dynamic Server", "versions": [{"status": "affected", "version": "14.10"}, {"status": "affected", "version": "15.0"}, {"status": "affected", "version": "12.10"}]}], "solutions": [{"lang": "en", "value": "The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on IBM Fix Central under the Informix Server section.", "supportingMedia": [{"type": "text/html", "value": "<p>The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on\u00a0<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?function=all&amp;parent=ibm~Information%20Management&amp;platform=All&amp;product=ibm%2FInformation%20Management%2FInformix&amp;release=All&amp;mhsrc=ibmsearch_a&amp;mhq=Informix\" rel=\"noopener noreferrer nofollow\">IBM Fix Central under the Informix Server section</a>.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7282827", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-12T21:01:16.803Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13476", "state": "PUBLISHED", "dateUpdated": "2026-08-14T22:16:24.859Z", "dateReserved": "2026-06-27T02:18:22.491Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-08-12T20:58:16.282Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:14.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10.0:*:*:*:*:*:*:*"], "product": "Informix Dynamic Server", "vendor": "IBM", "versions": [{"status": "affected", "version": "14.10"}, {"status": "affected", "version": "15.0"}, {"status": "affected", "version": "12.10"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:informix_dynamic_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "3435A2B1-6CDE-45A8-938B-D255381D8C76", "versionEndExcluding": "15.0.1.13", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*", "matchCriteriaId": "08A95A4E-A509-4FDB-BF4E-88B000C93DAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*", "matchCriteriaId": "B33D65F4-09CB-4C6C-8D0D-D9EA513F4E07", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*", "matchCriteriaId": "019A2188-0877-45DE-8512-F0BF70DD179C", "vulnerable": false}, {"criteria": "cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*", "matchCriteriaId": "F480AA32-841A-4E68-9343-B2E7548B0A0C", "vulnerable": false}, {"criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89", "vulnerable": false}, {"criteria": "cpe:2.3:o:ibm:linux_on_ibm_z:-:*:*:*:*:*:*:*", "matchCriteriaId": "B955E472-47E3-4C32-847B-F6BB05594BA3", "vulnerable": false}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:novell:suse_linux:-:*:*:*:*:*:*:*", "matchCriteriaId": "B627E2A9-DE93-43FB-BFB7-5B6F421554D5", "vulnerable": false}, {"criteria": "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*", "matchCriteriaId": "91F372EA-3A78-4703-A457-751B2C98D796", "vulnerable": false}, {"criteria": "cpe:2.3:o:redhat:desktop:-:*:*:*:*:*:*:*", "matchCriteriaId": "D8449790-8076-4EDD-AD55-5B849D3179E0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input."}, {"lang": "es", "value": "IBM Informix Dynamic Servidor 14.10, 15.0 y 12.10 podr\u00eda permitir a un usuario no autenticado ejecutar comyos arbitrarios con privilegios de cuenta de servicio en el sistema debido a una validaci\u00f3n incorrecta de la entrada proporcionada por el usuario."}], "id": "CVE-2026-13476", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13476", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T22:16:14.270959Z", "version": "2.0.3"}}]}, "published": "2026-08-12T21:17:35.510", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7282827"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.10"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Informix Dynamic Server", "source": "cna", "vendor": "IBM"}, "product": "informix_dynamic_server", "vendor": "ibm"}], "created": "2026-08-12T22:30:09.821145+00:00", "updated": "2026-08-13T02:30:12.395240+00:00", "vendors": ["ibm", "ibm$PRODUCT$informix_dynamic_server"]}