CVE-2026-13367 in Informix Dynamic Server
Summary
by MITRE • 08/12/2026
IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability exists within IBM Informix Dynamic Server versions 14.10 and 15.0 where the oninit utility executes with root privileges through setuid mechanism. This presents a critical security risk as the utility fails to properly validate or sanitize input parameters before executing system commands. The flaw allows local attackers to exploit the elevated privilege context and execute arbitrary code with root access, bypassing normal user permissions and system security controls.
This vulnerability maps directly to CWE-276 which describes improper privileges on resource access control objects, and specifically relates to CWE-78 which covers shell injection vulnerabilities. The technical implementation flaw occurs when the oninit utility processes command line arguments or environment variables without adequate input validation, potentially allowing malicious actors to inject commands that execute with root privileges. The setuid mechanism itself creates a trusted execution environment where user-supplied data can directly influence system behavior.
The operational impact of this vulnerability is severe as local attackers with minimal privileges can escalate their access to full system control. This enables unauthorized users to modify system files, install malware, create new administrative accounts, and potentially compromise the entire database server infrastructure. The vulnerability affects organizations running these specific Informix versions where database administrators may not have strict operational controls over local user access.
Mitigation strategies include immediate patching of affected IBM Informix versions to address the privilege escalation flaw, implementing strict input validation for all system utilities that execute with elevated privileges, and applying principle of least privilege concepts to reduce the attack surface. Organizations should also consider disabling unnecessary setuid binaries where possible and monitoring for unauthorized execution of oninit utility with root privileges. The ATT&CK framework categorizes this as privilege escalation through abuse of system utilities, specifically mapping to technique T1068 which covers local privilege escalation via setuid/setgid binaries. Security teams should implement process monitoring and integrity checking mechanisms to detect unauthorized modifications to the oninit utility or its execution environment.