{"id":"CVE-2026-93888","kind":"vulnerability","aliases":["CVE-2026-93888"],"related":[],"title":"IBM Sterling Connect Direct: apnotify utility code injection on Unix","description":"IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.","summary":"The apnotify utility in IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 does not validate user input properly. A local or remote party able to supply input to it can inject code that the utility runs.","severity":"high","cvss":7.8,"epss":0.00171,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","ibm-sterling-connect-direct","other","unix"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Connect Direct for Unix version against 6.3.0.0-6.3.0.7 and 6.4.0.0-6.4.0.6 (version command unknown from sources)\n- Locate the apnotify utility on the host and confirm whether it is present (path unknown from sources)","fix":"- Upgrade IBM Sterling Connect Direct for Unix to a fixed release (fixed version unknown from sources; see IBM advisory)","status":"open","published_at":"2026-10-20T22:21:07+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:08:26+00:00","updated_at":"2026-10-25T03:08:26+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:08:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade IBM Sterling Connect Direct for Unix to a fixed release (fixed version unknown from sources; see IBM advisory)","reach":"unknown","title":"IBM Sterling Connect Direct: apnotify utility code injection on Unix","impact":"high","summary":"The apnotify utility in IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 does not validate user input properly. A local or remote party able to supply input to it can inject code that the utility runs.","category":"other","nicknames":[],"who_cares":["ibm-sterling-connect-direct","unix","file-transfer"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker injects code that the utility executes on the host","analyst_note":"Find the IBM security bulletin for CVE-2026-93888 to confirm the fixed version, the attack vector, and whether authentication is required.","how_to_check":"- Check the installed Connect Direct for Unix version against 6.3.0.0-6.3.0.7 and 6.4.0.0-6.4.0.6 (version command unknown from sources)\n- Locate the apnotify utility on the host and confirm whether it is present (path unknown from sources)","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM Sterling Connect Direct for Unix in the affected 6.3 or 6.4 release ranges are exposed. The sources do not say which deployment settings or input paths are needed to reach the flaw, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00064,"input_tokens":3368,"output_tokens":607,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93888':13A,16A '6.3.0.0':38B,79C '6.3.0.7':40B,81C '6.4.0.0':42B,75C '6.4.0.6':44B,77C 'abl':56B 'apnotifi':5A,28B,82C 'code':7A,64B,88C 'connect':3A,23B,33B,71C 'cve':11A,14A 'direct':4A,24B,34B,72C 'due':90C 'file':18B 'file-transf':17B 'ibm':1A,21B,31B,69C 'ibm-sterling-connect-direct':20B 'inject':8A,63B,89C 'input':49B,59B,96C 'insuffici':92C 'local':52B 'parti':55B 'proper':50B 'remot':54B 'run':68B 'sterl':2A,22B,32B,70C 'suppli':58B 'transfer':19B 'unix':10A,26B,36B,74C 'user':48B,95C 'util':6A,29B,67B,83C 'valid':47B,93C 'version':37B 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Sterling Connect Direct for Unix in the affected 6.3 or 6.4 release ranges are exposed. The sources do not say which deployment settings or input paths are needed to reach the flaw, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93888","severity":null,"published_at":"2026-10-20T22:21:07+00:00","modified_at":"2026-10-22T23:20:33+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93888","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93888","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}