IBM Netezza Performance Server Replication Services up to 3.0.5.0 unnecessary privileges

Summaryinfo

A vulnerability categorized as critical has been discovered in IBM Netezza Performance Server Replication Services up to 3.0.5.0. The affected element is an unknown function. The manipulation results in unnecessary privileges. This vulnerability was named CVE-2026-3623. The attack needs to be approached locally. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM Netezza Performance Server Replication Services up to 3.0.5.0. It has been classified as critical. Affected is an unknown functionality. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. CWE is classifying the issue as CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

IBM Netezza Performance Server Replication Services 3.0.2.0 through 3.0.5.0 allows an attacker with low‑privileged access to escalate their privileges to root. By exploiting this flaw, the attacker can execute root‑level commands, obtain a root shell, and change the root user’s password. Successful exploitation also enables modification or removal of system‑wide files and the installation of persistent backdoors. This results in full system compromise with complete loss of confidentiality, integrity, and availability.

The advisory is shared for download at ibm.com. This vulnerability is traded as CVE-2026-3623 since 03/06/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/27/2026). The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• IBM

Name

• Netezza Performance Server Replication Services

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5.0

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion