IBM Informix Dynamic Server versions 12.10, 14.10, and 15.0 contain an OS command injection vulnerability (CWE-78) that arises from improper neutralization of special elements in user input. This flaw enables an unauthenticated attacker to execute arbitrary operating system commands with the service account's privileges on the affected system. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or remediation level has been provided yet by IBM, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to execute arbitrary OS commands with service account privileges, potentially leading to partial confidentiality, integrity, and availability impacts on the affected system.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Informix Dynamic Server and monitor for suspicious activity related to command execution attempts.