What is the CVSS score of CVE-2026-13367?

CVE-2026-13367 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM Informix Dynamic Server are affected by CVE-2026-13367?

IBM Informix Dynamic Server (versions 14.10 and 15.0) contains a local privilege escalation vulnerability enabling any low-privileged OS user to gain root access.. A patch is available.

How to fix or mitigate CVE-2026-13367?

Within 24 hours, identify and inventory all systems running IBM Informix 14.10 or 15.0, and confirm local user access policies. Within 7 days, apply the vendor-released patch to all affected production and staging instances, and implement tighter controls on local OS user provisioning where feasible. Within 30 days, extend patching to development and test environments, conduct vulnerability rescans to confirm remediation across all systems, and review local access control policies to reduce the attack surface of future local privilege escalation vulnerabilities.

IBM Informix Dynamic Server CVE-2026-13367

EUVD-2026-57623 HIGH

Improper Access Control (CWE-284)

2026-08-12 ibm

GHSA-ghg9-3j74-rj7c

Authentication Bypass Privilege Escalation IBM Informix Dynamic Server

7.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local setuid-root binary abuse requires an existing low-privileged OS account (AV:L, PR:L); no interaction needed; successful exploitation yields full root access (C:H/I:H/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 21:38 vuln.today

CVE Published

Aug 12, 2026 - 20:53 nvd

HIGH 7.8

DescriptionCVE.org

IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.

AnalysisAI

Local privilege escalation in IBM Informix Dynamic Server 14.10 and 15.0 allows any low-privileged local OS user to gain root access by exploiting improper access controls in the setuid-root oninit utility. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms a low-complexity local attack requiring no user interaction, resulting in full system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.

Technical ContextAI

IBM Informix Dynamic Server is an enterprise-grade relational database management system targeting high-throughput transactional workloads. The vulnerable component is oninit, the primary server initialization utility, which is installed with the setuid-root bit to allow the Informix runtime user to perform privileged system operations during startup. CWE-284 (Improper Access Control) at the root indicates the utility fails to enforce adequate restrictions on the operations a low-privileged invoking user can perform - a classic setuid binary abuse class where the process inherits root effective UID without sufficiently constraining caller privileges. The CPE string cpe:2.3:a:ibm:informix_dynamic_server:*:*:*:*:*:*:*:* covers all platform variants, with the advisory scoping the affected surface to the 14.10 and 15.0 release trains.

RemediationAI

Apply the vendor-released patch available from IBM's support portal at https://www.ibm.com/support/pages/node/7282829. The exact patched version number was not specified in the available intelligence data and must be confirmed directly from the advisory for your specific release (14.10 or 15.0). As a compensating control pending patching, restrict local shell access to the Informix host to only explicitly trusted database administrators, removing or disabling any non-essential OS-level accounts. A targeted interim measure is removing the setuid bit from the oninit binary (chmod u-s $(which oninit)); however, this will likely disrupt standard Informix service startup operations and should be validated in a non-production environment before deployment. Audit all local users on Informix hosts and enforce principle of least privilege at the OS level to reduce the pool of potential exploiters.