Informix Dynamic Server CVE-2026-13476

No special conditions are required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against IBM Informix Dynamic Server 12.10, 14.10, and 15.0 with no prerequisite authentication credential, no specific feature toggle, and no user interaction needed. The sole practical limiting factor is network reachability: if Informix service ports are firewalled to trusted application hosts only, an external attacker cannot reach the vulnerable component. Post-exploitation impact is further constrained by the privilege level of the Informix service account; environments running the service under a non-root, least-privilege account reduce the attacker's ability to pivot beyond database-related file system paths.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) signals high exploitability on every access-related axis: the attack is fully remote, requires no authentication, imposes no complexity barrier, and demands no user interaction - a combination that makes this straightforward to exploit at scale against any reachable instance. However, the Scope:Unchanged designation and the triple-Low CIA ratings moderate the score to 7.3 rather than Critical, reflecting that post-exploitation impact is bounded by the service account's privilege level rather than yielding full system compromise in hardened configurations. No EPSS score was provided for quantitative exploitation probability estimation, and neither a CISA KEV listing nor public proof-of-concept code has been identified at the time of analysis, leaving active exploitation status unconfirmed. Despite the absence of confirmed in-the-wild use, the unauthenticated network vector means even a mid-sized municipal IT team in kielce managing Informix deployments should treat this as urgent if those services are exposed beyond a trusted internal network segment. The apparent tension between the trivial exploit path and the moderate CVSS score is explained by constrained CIA impact metrics, not by any meaningful exploitation difficulty - attack complexity is genuinely low.

An unauthenticated attacker with network access to the IBM Informix Dynamic Server sends a crafted request embedding OS command metacharacters to a network-exposed server component, bypassing input validation. The server passes the unsanitized input directly to a system shell, causing the injected commands to execute under the Informix service account. The attacker could then enumerate the host environment, read database and configuration files accessible to that account, or attempt lateral movement into adjacent systems on the same network segment.