Netezza Performance Server CVE-2026-3623

Exploitation requires a local foothold on a system running IBM Netezza Performance Server Replication Services version 3.0.2.0 through 3.0.5.0, plus an existing authenticated low-privileged account on that appliance (CVSS PR:L), and the affected Replication Services component must be present/installed. What limits exploitation: the attack vector is local (AV:L), so it cannot be triggered remotely over the network and the attacker must already be on the host; it requires valid low-privileged credentials or an existing account, so a fully anonymous external actor cannot use it directly; and it is constrained to the affected 3.0.2.0-3.0.5.0 version band. What does NOT limit it: no user interaction is required (UI:N) and attack complexity is low (AC:L), so once a local account exists, escalation to root is reliable and straightforward.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack vector is local (AV:L), so the attacker must already have access to the appliance, and privileges required are low (PR:L), meaning an authenticated low-privileged foothold is a prerequisite - this is not a remotely reachable, unauthenticated bug. Offsetting those limits, attack complexity is low (AC:L), no user interaction is needed (UI:N), and the impact is total (C:H/I:H/A:H) once the foothold exists, which is why the score remains high. No EPSS exploitation-probability score, no CISA KEV listing, and no public proof-of-concept were present in the provided data, so all three of the strongest 'real-world exploitation' signals are currently absent or unknown. No SSVC decision values were supplied either. Net assessment: this is a credible escalation-of-privilege priority for any environment where untrusted or semi-trusted users hold local accounts on Netezza appliances, but the local-plus-authenticated precondition makes it a second-stage/post-compromise risk rather than an internet-facing emergency. The absence of an EPSS score and KEV entry should be read as 'not yet measured/observed,' not as evidence of low risk.

An attacker who has obtained a low-privileged local account on a Netezza appliance - for example a limited operator login, a compromised service account, or an insider - invokes the over-privileged Replication Services functionality to run commands in root context. With low attack complexity and no user interaction required, they escalate to a root shell, reset the root password, and install a persistent backdoor to retain control. No public exploit code was identified in the provided data, so this scenario reflects the vendor-described capability rather than a published PoC.