IBM Informix Dynamic Server CVE-2026-13367

Exploitation requires an existing local OS-level account on a host running IBM Informix Dynamic Server 14.10 or 15.0, with at least low-privileged shell access (confirmed by CVSS PR:L). The oninit binary must be present on the system with its setuid-root bit intact, which is a standard default installation condition - no non-default configuration is required. Network access is not required (AV:L), so remote exploitation is only possible if chained after a separate initial-access vulnerability. Exploitation is limited to local users; external attackers without a foothold on the Informix host cannot directly reach this attack surface. No specific Informix feature activation or configuration mode is cited as a prerequisite beyond a standard installed instance.

The CVSS 3.1 score of 7.8 (High) is driven by AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local access with no complexity or interaction requirements yields a full-CIA impact, which is an accurate reflection of root escalation. Real-world risk is meaningfully bounded by the local attack vector: remote unauthenticated attackers cannot exploit this directly and must first obtain a shell on the target host. No EPSS score was provided in the intelligence data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed broad or opportunistic exploitation at time of analysis. The tags flag both 'Authentication Bypass' and 'Privilege Escalation', which may indicate the access control failure also bypasses authentication checks within the binary itself, though this is inferred from tags rather than confirmed by the description. The attack class - setuid-root binary exploitation - is extremely well-understood, meaning technical barrier is low for any attacker who has achieved local access. Risk is highest for organizations running Informix on shared infrastructure or where OS-level user separation is a meaningful security boundary.

An attacker who has obtained a low-privileged local shell on an IBM Informix host - via phishing, credential theft, or exploitation of a separate vulnerability - invokes the setuid-root oninit binary with crafted arguments or environment manipulation that bypasses its access control checks. Because the binary runs with root effective UID, the access control failure allows the attacker to execute arbitrary operations as root, achieving full host compromise. No public proof-of-concept has been identified at time of analysis, but the setuid binary abuse class is thoroughly documented and the AC:L vector confirms low technical complexity.