{"api_version":"1","generated_at":"2026-08-20T13:19:49+00:00","cve":"CVE-2026-13476","urls":{"html":"https://cve.report/CVE-2026-13476","api":"https://cve.report/api/cve/CVE-2026-13476.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-13476","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-13476"},"summary":{"title":"IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution","description":"IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-08-12 21:17:35","updated_at":"2026-08-18 18:38:48"},"problem_types":["CWE-78","CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.3","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7282827","name":"https://www.ibm.com/support/pages/node/7282827","refsource":"psirt@us.ibm.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13476","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13476","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Informix Dynamic Server","version":"affected 14.10","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Informix Dynamic Server","version":"affected 15.0","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Informix Dynamic Server","version":"affected 12.10","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on IBM Fix Central under the Informix Server section.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"canonical","cpe5":"ubuntu_linux","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"hp","cpe5":"hp-ux","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"aix","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"informix_dynamic_server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"informix_dynamic_server","cpe6":"12.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"informix_dynamic_server","cpe6":"14.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"linux_on_ibm_z","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"novell","cpe5":"suse_linux","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"oracle","cpe5":"solaris","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"13476","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"desktop","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"13476","cve":"CVE-2026-13476","epss":"0.005490000","percentile":"0.433910000","score_date":"2026-08-18","updated_at":"2026-08-19 00:07:28"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-13476","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-14T22:16:14.270959Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-14T22:16:24.859Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*","cpe:2.3:a:ibm:informix_dynamic_server:14.10.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:informix_dynamic_server:15.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:informix_dynamic_server:15.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*","cpe:2.3:a:ibm:informix_dynamic_server:12.10.0:*:*:*:*:*:*:*"],"product":"Informix Dynamic Server","vendor":"IBM","versions":[{"status":"affected","version":"14.10"},{"status":"affected","version":"15.0"},{"status":"affected","version":"12.10"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.</p>"}],"value":"IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-12T21:01:16.803Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7282827"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on <a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?function=all&amp;parent=ibm~Information%20Management&amp;platform=All&amp;product=ibm%2FInformation%20Management%2FInformix&amp;release=All&amp;mhsrc=ibmsearch_a&amp;mhq=Informix\" rel=\"noopener noreferrer nofollow\">IBM Fix Central under the Informix Server section</a>.</p>"}],"value":"The vulnerability has been resolved in IBM Informix versions 14.10.xC13W13 and 15.0.1.13. The fix can be found on IBM Fix Central under the Informix Server section."}],"title":"IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-13476","datePublished":"2026-08-12T20:58:16.282Z","dateReserved":"2026-06-27T02:18:22.491Z","dateUpdated":"2026-08-14T22:16:24.859Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-12 21:17:35","lastModifiedDate":"2026-08-18 18:38:48","problem_types":["CWE-78","CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T22:16:14.270959Z","id":"CVE-2026-13476","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:informix_dynamic_server:*:*:*:*:*:*:*:*","versionStartIncluding":"15.0","versionEndExcluding":"15.0.1.13","matchCriteriaId":"3435A2B1-6CDE-45A8-938B-D255381D8C76"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:informix_dynamic_server:12.10:*:*:*:*:*:*:*","matchCriteriaId":"08A95A4E-A509-4FDB-BF4E-88B000C93DAC"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*","matchCriteriaId":"B33D65F4-09CB-4C6C-8D0D-D9EA513F4E07"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*","matchCriteriaId":"019A2188-0877-45DE-8512-F0BF70DD179C"},{"vulnerable":false,"criteria":"cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*","matchCriteriaId":"F480AA32-841A-4E68-9343-B2E7548B0A0C"},{"vulnerable":false,"criteria":"cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*","matchCriteriaId":"E492C463-D76E-49B7-A4D4-3B499E422D89"},{"vulnerable":false,"criteria":"cpe:2.3:o:ibm:linux_on_ibm_z:-:*:*:*:*:*:*:*","matchCriteriaId":"B955E472-47E3-4C32-847B-F6BB05594BA3"},{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"},{"vulnerable":false,"criteria":"cpe:2.3:o:novell:suse_linux:-:*:*:*:*:*:*:*","matchCriteriaId":"B627E2A9-DE93-43FB-BFB7-5B6F421554D5"},{"vulnerable":false,"criteria":"cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*","matchCriteriaId":"91F372EA-3A78-4703-A457-751B2C98D796"},{"vulnerable":false,"criteria":"cpe:2.3:o:redhat:desktop:-:*:*:*:*:*:*:*","matchCriteriaId":"D8449790-8076-4EDD-AD55-5B849D3179E0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"13476","Ordinal":"1","Title":"IBM Informix Wire Listener Vulnerable to Unauthenticated Remote ","CVE":"CVE-2026-13476","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"13476","Ordinal":"1","NoteData":"IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.","Type":"Description","Title":"IBM Informix Wire Listener Vulnerable to Unauthenticated Remote "}]}}}