CERT-FR Advisory Covers Multiple IBM Products
CERT-FR advisory lists numerous vulnerabilities across IBM AIX, Db2, QRadar, Sterling Control Center, VIOS and WebSphere requiring patching.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 32 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-44487 as exploited in the wild.
CERT-FR published a consolidated advisory (CERTFR-2026-AVI-1472) covering multiple vulnerabilities across a wide range of IBM products, including AIX versions 7.2 and 7.3, Db2 Genius Hub and Agentics, Db2 Query Management Facility, Db2 on Cloud Pak for Data, the QRadar SIEM family (SIEM, Data Synchronization App, User Behavior Analytics, Suite Software, Log Management AQL Plugin), Sterling Control Center, VIOS, and WebSphere Application Server (including Liberty). The issues span a broad risk spectrum: remote code execution, privilege escalation, remote denial of service, data integrity and confidentiality compromise, security bypass, SSRF, XSS, CSRF, and SQL injection. IBM has released or scheduled patches via numerous security bulletins issued between November 1-5, 2026, with some WebSphere fixes not expected until Q4 2026 or Q1 2027.
The advisory references an extremely large number of CVEs (hundreds), spanning years from 2022 through 2026, indicating this bulletin aggregates fixes for third-party components (such as Semeru/JRE runtimes bundled with Db2 QMF) as well as IBM-specific code. No indication is given of active exploitation in the wild for any of these CVEs; this is a routine vendor patch aggregation advisory rather than a report of an ongoing attack or campaign. Defenders running any of the affected IBM products should consult the referenced IBM security bulletins for applicable CVEs matching their deployed versions and apply fixes or interim fixes (iFixes) as scheduled, prioritizing systems reachable from untrusted networks and those running QRadar/SIEM or WebSphere Application Server given the RCE and privilege escalation risks.
Because this is a CERT-FR bulletin aggregating an original vendor's (IBM's) own patch release notes across many products, it functions as a primary advisory rather than a third-party rollup, and should be treated as actionable guidance for IBM shops to assess exposure and patch accordingly.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1472
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs