CVE-2026-8862

IBM Netezza Software 11.3.0.3 through Interim Fix 002 contains hardcoded credentials in the application source code (CWE-522, insufficiently protected credentials), which allow unauthorized access to the product's container registry. Because the secret is embedded in the code and requires no privileges or user interaction to use (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), an attacker with network access can authenticate to the registry using the embedded credential. Successful abuse lets the attacker pull private container images, potentially exposing proprietary code, configuration details, and other sensitive information. Anyone running an affected IBM Netezza Software release in the 11.3.0.3 through Interim Fix 002 range is in scope. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.2%, so no exploitation is currently known.

What to do: Upgrade Netezza Software to a fixed release/interim fix newer than 11.3.0.3 IF002 per IBM's advisory. Until patched, restrict network access to the container registry, treat the embedded registry credential as compromised by rotating it, and review registry access logs for unauthorized pulls of private images.