CVE-2026-13476

Received Received - Intake

Unauthenticated Command Execution in IBM Informix Dynamic Server

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: IBM Corporation

Description

IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-13476

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	informix_dynamic_server	14.10
ibm	informix_dynamic_server	15.0
ibm	informix_dynamic_server	12.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Informix Dynamic Server allows an unauthenticated user to execute arbitrary commands with the privileges of the service account on the system. This occurs due to improper validation of user-supplied input, which can be exploited remotely without any authentication.

Impact Analysis

An attacker could gain control over the system by executing arbitrary commands with elevated privileges. This may lead to unauthorized data access, modification, or deletion, system compromise, and potential lateral movement within a network.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Apply the latest security patches or updates from IBM for Informix Dynamic Server versions 14.10, 15.0, and 12.10 to address improper input validation. Restrict network access to the service and monitor for unauthorized command execution attempts.

Hi! I’m here to help you understand CVE-2026-13476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70