CVE-2026-13367 Overview
CVE-2026-13367 is a local privilege escalation vulnerability affecting IBM Informix Dynamic Server versions 14.10 and 15.0. The flaw resides in the oninit setuid-root utility, a core component of the Informix database engine. An authenticated local attacker can abuse improper access control in this binary to elevate privileges to root on the underlying host. The weakness is classified under [CWE-284: Improper Access Control].
Critical Impact
Successful exploitation grants root-level control of the database server, exposing all data, credentials, and services running on the host.
Affected Products
- IBM Informix Dynamic Server 14.10
- IBM Informix Dynamic Server 15.0
- oninit setuid-root utility shipped with the above releases
Discovery Timeline
- 2026-08-12 - CVE-2026-13367 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-13367
Vulnerability Analysis
The oninit binary is the primary Informix server process and ships with the setuid-root bit set so that non-root database administrators can start and manage instances. Because the binary executes with root privileges regardless of the invoking user, any improper access control inside the utility becomes a direct path to full system compromise. According to IBM, the flaw allows a local user with existing low-privilege access to escalate to root through the utility. The attack does not require user interaction and executes entirely within the local session context.
Root Cause
The root cause is improper access control [CWE-284] within the setuid-root oninit utility. The program fails to enforce sufficient privilege checks on an operation it exposes to unprivileged callers. Because setuid binaries retain root effective UID throughout execution, any missing authorization check translates into a privilege boundary violation. IBM has not published low-level technical details of the flawed code path. Refer to the IBM Support Page for vendor guidance.
Attack Vector
Exploitation requires local access and valid low-privileged credentials on the host running IBM Informix. An attacker with a shell as any user permitted to invoke oninit can trigger the vulnerable code path to gain root. Typical prerequisites include shell access on the database server, either through a compromised service account, a stolen SSH key, or a chained web vulnerability. Since Informix installations often run on hardened database tiers, the vulnerability is most valuable to attackers pivoting from an initial foothold into full host takeover. No network-based exploitation path has been disclosed.
No public proof-of-concept has been released. Technical specifics of the vulnerable code path are documented only in the vendor advisory.
Detection Methods for CVE-2026-13367
Indicators of Compromise
- Unexpected invocations of oninit by user accounts that are not members of the Informix administrator group.
- New root-owned processes spawned as children of oninit outside normal database startup windows.
- Unusual privilege transitions in /var/log/auth.log or audit.log correlated with Informix binary execution.
Detection Strategies
- Enable Linux auditd rules on the oninit binary path to log every execve and capture the invoking UID.
- Baseline expected callers of oninit and alert on invocations from unexpected users, sessions, or parent processes.
- Hunt for post-execution artifacts such as new root cron entries, modified /etc/passwd, or SUID binaries dropped after an oninit call.
Monitoring Recommendations
- Forward host authentication and process-execution telemetry to a centralized analytics platform for correlation across database servers.
- Monitor filesystem changes in Informix installation directories, particularly permission changes on setuid binaries.
- Review database server login history for lateral-movement patterns that precede local privilege escalation attempts.
How to Mitigate CVE-2026-13367
Immediate Actions Required
- Apply the IBM-provided fix for Informix Dynamic Server 14.10 and 15.0 as documented on the IBM Support Page.
- Restrict shell access on Informix database hosts to the minimum set of administrators required for operations.
- Audit membership of the Informix administration group and remove accounts that no longer require database privileges.
Patch Information
IBM has published remediation guidance on the IBM Support Page. Administrators should identify the exact fix pack matching their installed version of Informix Dynamic Server 14.10 or 15.0 and apply it through the standard IBM upgrade procedure. Verify the patch by confirming updated binary versions after installation.
Workarounds
- Limit local logon rights on Informix database hosts using operating-system access controls until the patch can be deployed.
- Enforce strict filesystem permissions on the Informix installation directory to reduce the exposure of the oninit binary.
- Enable host-level auditing for setuid binary execution to detect exploitation attempts while patching is scheduled.
# Configuration example: audit oninit execution on Linux hosts
auditctl -w /opt/informix/bin/oninit -p x -k informix_oninit_exec
ausearch -k informix_oninit_exec --start today
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
