{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13476", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-06-27T02:18:22.491Z", "datePublished": "2026-08-12T20:58:16.282Z", "dateUpdated": "2026-08-12T21:01:16.803Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-12T21:01:16.803Z"}, "title": "IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Informix Dynamic Server", "versions": [{"status": "affected", "version": "14.10"}, {"status": "affected", "version": "15.0"}, {"status": "affected", "version": "12.10"}], "cpes": ["cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:14.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7282827", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on IBM Fix Central under the Informix Server section.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on\u00a0<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?function=all&amp;parent=ibm~Information%20Management&amp;platform=All&amp;product=ibm%2FInformation%20Management%2FInformix&amp;release=All&amp;mhsrc=ibmsearch_a&amp;mhq=Informix\" rel=\"noopener noreferrer nofollow\">IBM Fix Central under the Informix Server section</a>.</p>"}]}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:14.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:15.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:informix_dynamic_server:12.10.0:*:*:*:*:*:*:*"], "product": "Informix Dynamic Server", "vendor": "IBM", "versions": [{"status": "affected", "version": "14.10"}, {"status": "affected", "version": "15.0"}, {"status": "affected", "version": "12.10"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input."}], "id": "CVE-2026-13476", "lastModified": "2026-08-12T22:17:14.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "psirt@us.ibm.com", "type": "Secondary"}]}, "published": "2026-08-12T21:17:35.510", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7282827"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.10"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Informix Dynamic Server", "source": "cna", "vendor": "IBM"}, "product": "informix_dynamic_server", "vendor": "ibm"}], "created": "2026-08-12T22:30:09.821145+00:00", "updated": "2026-08-13T02:30:12.395240+00:00", "vendors": ["ibm", "ibm$PRODUCT$informix_dynamic_server"]}