Loading story…
IBM disclosed CVE-2026-13361, a high-severity remote code execution flaw in the SQL Interface Handler of IBM Informix Dynamic Server. The vulnerability stems from an unchecked SQL Interface length field in oninit sq_sgkprepare, allowing an authenticated SQL Interface client to trigger a stack-based buffer overflow with a specially crafted request. IBM rated the issue CVSS 8.8 and said affected releases include Informix Dynamic Server 12.10.x, 14.10, and 15.0.
The weakness aligns with CWE-121, in which data written past a stack buffer can corrupt control-flow data and lead to crashes or arbitrary code execution. IBM said the flaw is fixed in Informix 14.10.xC13W13 and 15.0.1.14, and noted that no workarounds or mitigations are available, making vendor patching the primary remediation path for exposed deployments.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
IBM disclosed CVE-2026-13361, a remote code execution vulnerability in the SQL Interface component of IBM Informix Dynamic Server caused by an unchecked length field leading to a stack-based buffer overflow. IBM said affected versions include 12.10.x, 14.10, and 15.0, and that fixes are available in 14.10.xC13W13 and 15.0.1.14 with no workarounds or mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM disclosed **CVE-2026-10109**, a critical remote code execution flaw in **IBM Db2** caused by improper handling of the pre-authentication **DRDA handshake**. The vulnerability is tracked as **CWE-94** and carries a **CVSS 3.1 score of 9.8**, indicating that attackers can exploit it remotely over the network without privileges or user interaction. The issue affects **IBM Db2 Server** versions **11.5.0 through 11.5.9** and **12.1.0 through 12.1.4** across all platforms. IBM said there is **no workaround or mitigation** and directed customers to obtain interim special builds and the latest security fixes through **Fix Central** to remediate exposed systems.
Jun 30, 2026
IBM disclosed **CVE-2026-10543**, a high-severity privilege-escalation vulnerability in **IBM Db2** that can be triggered with a specially crafted query. The flaw is classified as **CWE-285 Improper Authorization** and carries a **CVSS v3.1 score of 8.2** with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N`, indicating low-complexity, network-exploitable abuse with no user interaction required and a high integrity impact. The issue affects **IBM Db2 Server** versions **11.5.0 through 11.5.9** and **12.1.0 through 12.1.5** on all platforms. IBM said interim security updates are available through **Fix Central** for supported release levels, while noting that **no workarounds or mitigations** are available. The company withheld detailed exploitation guidance to reduce attacker enablement and credited **Nicolas Verdier of Amazon** with reporting the vulnerability.
Aug 13, 2026
IBM disclosed multiple high-severity vulnerabilities affecting **WebSphere** and **webMethods Integration Server**, exposing enterprise middleware environments to remote compromise. In WebSphere, the reported issues include remote code execution flaws tracked as `CVE-2026-9311`, `CVE-2026-9330`, and `CVE-2026-9319`, alongside an authentication bypass and identity spoofing issue, `CVE-2026-8644`. Affected deployments include traditional WebSphere versions **9.0** and **8.5**, with IBM issuing interim fixes through specific APARs and urging administrators to verify configurations and apply patches quickly. A separate IBM advisory covers **webMethods Integration Server** `CVE-2025-36072`, a deserialization-based remote code execution flaw that can be exploited by an authenticated attacker with service execution privileges through internal APIs or protocols such as `IDataBin`. The vulnerability affects versions **10.11** through `10.11_Core_Fix22`, **10.15** through `10.15_Core_Fix22`, and **11.1** through `11.1_Core_Fix6` if they have not received the latest core fixes. Successful exploitation could allow arbitrary code execution in the Integration Server process, enabling lateral movement, persistence, and data exfiltration across business-critical systems.
Jun 29, 2026