IBM Sterling Connect:Direct for UNIX: Code injection in apnotify utility
Summary
IBM Sterling Connect:Direct for UNIX versions 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 contain a code injection vulnerability in the apnotify utility, caused by insufficient validation of user input. The utility is mainly found on installations that were upgraded in place from 2017 or earlier. An attacker with a local account on the host could potentially run code with the rights of the affected component, with a CVSS base score of 7.8 (High). Attack needs local access and low privileges; no user interaction is required.
Affected
- IBM Sterling Connect:Direct for UNIX 6.4.0.0 to 6.4.0.6.iFix021
- IBM Sterling Connect:Direct for UNIX 6.3.0.0 to 6.3.0.7.iFix032
- Older branches: Unknown.
Fixed in
- 6.4 branch: Apply 6.4.0.6.iFix022 (included in 6.4.0.6.iFix025, available on Fix Central).
- 6.3 branch: Apply 6.3.0.7.iFix033 (available on Fix Central).
Workaround
- None documented by IBM.
- Until patched, limit local shell access to Connect:Direct hosts.
Exploitation
- No evidence of active exploitation found; not listed in CISA KEV according to aggregator sites.
- No public proof-of-concept exploit found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether Connect:Direct for UNIX is installed, especially on hosts upgraded in place from 2017 or earlier, and whether apnotify is present.
- Patch to 6.4.0.6.iFix025 or later, or 6.3.0.7.iFix033, after verifying the iFix list on IBM Fix Central.
- Restrict local shell and service account access on these hosts until patched.
- Review system logs for abnormal activity after patching.
- Verify CVE-2026-105453 on the same versions and patch both together.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (node 7292127) www.ibm.com
- Vulners CVELIST record vulners.com
- GitHub Advisory GHSA-pmwr-56q5-p44p github.com
- VulDB entry 423193 vuldb.com
- TheHackerWire CVE-2026-93888 www.thehackerwire.com
- OpenCVE CVE-2026-93888 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:52.
Original description (NVD)
IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.