EUVD-2026-106857
GHSA-pmwr-56q5-p44p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged shell
-
DeliveryCraft malicious input for apnotify
-
ExploitTrigger stack buffer overflow
-
ExecutionExecute injected code at elevated privilege
-
ImpactGain full host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a Unix host running IBM Sterling Connect:Direct for Unix at an affected version (6.4.0.0-6.4.0.6 or 6.3.0.0-6.3.0.7) and the ability to invoke the apnotify utility with attacker-supplied input. LIMITING FACTORS: the attacker must already possess valid local credentials at low privilege (PR:L, AV:L) - there is no network-facing exposure and no remote or unauthenticated path. Impact is bounded to the host (S:U, no scope change). Risk is therefore concentrated on multi-user or shared file-transfer servers where untrusted local accounts exist; single-tenant hardened hosts with no untrusted local users face substantially lower realistic exposure. |
| Impact | This is a locally-exploitable privilege-escalation-class flaw, not a remotely-wormable one. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates an attacker must already have local, low-privileged access to the host and can then achieve full confidentiality, integrity, and availability impact - consistent with a setuid/privileged helper (the apnotify utility) being abused to run attacker-controlled code at a higher privilege level. No EPSS score, CISA KEV entry, or public PoC was provided in the intelligence, so there is no evidence of active exploitation or published exploit code at time of analysis. Net priority: moderate - the local attack vector sharply limits mass exploitation and keeps real-world risk below what the 7.8 'High' label alone suggests, but on multi-user or shared file-transfer hosts it is a credible local-to-root escalation and should be patched on a normal cycle. CONFLICTING-SIGNAL NOTE: the CWE is CWE-121 (stack-based buffer overflow) and the tags say Buffer Overflow / Stack Overflow, yet the description characterizes the issue as 'code injection due to insufficient validation of user input' - the two framings are reconcilable (a stack overflow leading to code execution) but the exact mechanism should be verified against the IBM advisory. |
| Exploit ScenarioDerived | A low-privileged local user on a host running IBM Sterling Connect:Direct for Unix invokes the apnotify utility with maliciously crafted input that overflows a stack buffer, causing attacker-controlled code to execute in the context of the privileged utility. Because the CVSS scope is unchanged but impact is High across C/I/A, this realistically yields privilege escalation on the affected host. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Local code injection in IBM Sterling Connect:Direct for Unix's apnotify utility can let an authenticated low-privileged user trigger a stack-based buffer overflow and potentially execute code with the host privileges of the utility. The flaw affects versions 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 and requires local access plus the ability to invoke apnotify with crafted input; there is no remote or unauthenticated path. No public exploit identified at time of analysis, and CISA KEV status is not indicated, so risk is concentrated on shared Unix hosts with untrusted local accounts.
RemediationAI
Apply the IBM Sterling Connect:Direct for Unix fix identified in IBM support advisory node/7292127; the provided data does not include an exact patched version, so confirm the fixed 6.3.x and 6.4.x maintenance levels in that advisory before upgrading. Until patched, reduce exposure by restricting local login and execution rights on hosts running Connect:Direct, removing or tightly controlling untrusted local accounts, and limiting who can invoke apnotify through filesystem permissions or sudo policy; these controls lower the local attack surface but do not fix the underlying stack overflow. Shared or multi-tenant file-transfer servers should be prioritized for upgrade and local-account auditing because the assessed prerequisite is low-privileged local access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-121, stack-based buffer overflow, which aligns with the supplied tags 'Buffer Overflow' and 'Stack Overflow.' IBM's description characterizes the issue as code injection resulting from insufficient validation of user input in the apnotify utility; these are consistent if attacker-controlled input is passed into a fixed-size stack buffer without bounds checking, corrupting return addresses or control data and potentially leading to code execution with the utility's privileges. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that exploitation requires local access, low privileges, and no user interaction, and that impact remains scoped to the same host. No CPE strings were included in the provided data, so exact affected builds should be confirmed against IBM's advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Flaw is reached only by a local authenticated user invoking apnotify (AV:L, PR:L), reliably triggerable (AC:L), and code execution in the privileged utility yields full host C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.
Executive ViewAI
IBM Sterling Connect:Direct for Unix 6.4.0.0-6.4.0.6 and 6.3.0.0-6.3.0.7 include a local code injection weakness in the apnotify utility that could let a low-privileged user on a shared host run code with the utility's privileges. Because no public exploit identified at time of analysis and local access is required, the business risk is concentrated on shared Unix environments with untrusted local users; leadership should prioritize asset visibility, local access governance, and readiness for a vendor fix.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local access to affected Unix hosts, removing or limiting execute permissions on apnotify for low-privileged users, monitoring process execution for apnotify, auditing shared hosts for unnecessary local accounts, and isolating affected systems where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB