{"id":"CVE-2026-16699","kind":"vulnerability","aliases":["CVE-2026-16699"],"related":[],"title":"IBM Netezza Appliance: authenticated users can change other users' passwords","description":"IBM Netezza Appliance 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 could allow a remote authenticated attacker to change the passwords of other users due to improper authorization.","summary":"IBM Netezza Appliance versions 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 fail to check authorization properly. A remote attacker with a valid account can change the passwords of other users.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-warehouse","ibm","infrastructure","netezza"],"not_affected_if":["no-remote-accounts"],"how_to_check":"- Check the installed Netezza Appliance release and interim fix level against the affected range `11.3.0.2 Interim Fix 002` through `11.3.1.3 Interim Fix 006`","fix":null,"status":"open","published_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:44+00:00","updated_at":"2026-11-08T18:22:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:22:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Netezza Appliance: authenticated users can change other users' passwords","impact":"medium","summary":"IBM Netezza Appliance versions 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 fail to check authorization properly. A remote attacker with a valid account can change the passwords of other users.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netezza","ibm","data-warehouse"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker changes passwords of other appliance users, enabling account takeover","analyst_note":"Confirm the fixed release and remediation from the IBM security bulletin for CVE-2026-16699; the sources give only NVD.","how_to_check":"- Check the installed Netezza Appliance release and interim fix level against the affected range `11.3.0.2 Interim Fix 002` through `11.3.1.3 Interim Fix 006`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-remote-accounts"],"who_is_affected":"Organisations running IBM Netezza Appliance in the affected release range are exposed if remote users hold accounts on the appliance. Systems outside that range, or where no remote authenticated users exist, are less exposed. The sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4553,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16699':13A,16A '-2026':12A,15A '002':30B,61C '006':35B,66C '11.3.0.2':27B,58C '11.3.1.3':32B,63C 'account':47B 'allow':68C 'applianc':3A,25B,57C 'attack':43B,72C 'authent':4A,71C 'author':39B,83C 'chang':7A,49B,74C 'check':38B 'could':67C 'cve':11A,14A 'data':18B 'data-warehous':17B 'due':80C 'fail':36B 'fix':29B,34B,60C,65C 'ibm':1A,20B,23B,55C 'improp':82C 'infrastructur':21B 'interim':28B,33B,59C,64C 'netezza':2A,22B,24B,56C 'password':10A,51B,76C 'proper':40B 'remot':42B,70C 'user':5A,9A,54B,79C 'valid':46B 'version':26B 'warehous':19B","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM Netezza Appliance in the affected release range are exposed if remote users hold accounts on the appliance. Systems outside that range, or where no remote authenticated users exist, are less exposed. The sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datawarehouse","ibm","infrastructure","medium","netezza"],"campaign_type":null,"search_a":"'-16699':13A,16A '-2026':12A,15A 'applianc':3A 'authent':4A 'chang':7A 'cve':11A,14A 'ibm':1A 'netezza':2A 'password':10A 'user':5A,9A","search_b":"'002':30B '006':35B '11.3.0.2':27B '11.3.1.3':32B 'account':47B 'applianc':25B 'attack':43B 'author':39B 'chang':49B 'check':38B 'data':18B 'data-warehous':17B 'fail':36B 'fix':29B,34B 'ibm':20B,23B 'infrastructur':21B 'interim':28B,33B 'netezza':22B,24B 'password':51B 'proper':40B 'remot':42B 'user':54B 'valid':46B 'version':26B 'warehous':19B","search_c":"'002':61C '006':66C '11.3.0.2':58C '11.3.1.3':63C 'allow':68C 'applianc':57C 'attack':72C 'authent':71C 'author':83C 'chang':74C 'could':67C 'due':80C 'fix':60C,65C 'ibm':55C 'improp':82C 'interim':59C,64C 'netezza':56C 'password':76C 'remot':70C 'user':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16699","severity":null,"published_at":"2026-11-08T18:17:03+00:00","modified_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}