Multiple vulnerabilities across IBM product portfolio
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory covering 150+ CVEs affecting IBM databases, QRadar, WebSphere, and Sterling products enabling remote code execution and privilege escalation.
CERT-FR has published a coordinated advisory documenting multiple vulnerabilities across a wide range of IBM enterprise products. The affected portfolio includes Db2 database versions, QRadar security analytics platforms, WebSphere Application Server, and Sterling file-transfer and secure-proxy solutions. The vulnerabilities span a range of impact categories including remote code execution, privilege escalation, denial of service, server-side request forgery, cross-site scripting, and data confidentiality and integrity violations. The advisory references over 150 CVE identifiers published between 2020 and 2026, with the most recent batch disclosed in July 2026. Defenders should prioritize patching based on which IBM products are deployed in their environment, cross-referencing the specific version ranges listed against their inventory. IBM has published separate security bulletins for each affected product line with version-specific remediation.
Mentioned in this report
Detection guidance
WebSphere Java Process Spawning Command Shell or Scripting Interpreter on Windows
WebSphere Application Server's java.exe spawning cmd, PowerShell or other script hosts, which is typical post-exploitation of an RCE flaw in a public-facing app server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Command Shell or Scripting Interpreter on Windows
description: Detects the IBM WebSphere Application Server JVM spawning a command interpreter
or script host. Exploiting RCE flaws in public-facing Java application servers (T1190)
typically yields shell/script child processes (T1059) of the server process. Generalises
on the parent/child relation, not on any specific CVE or payload.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \WebSphere\
ParentImage|endswith: \java.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
filter_admin_scripts:
CommandLine|contains:
- startServer
- stopServer
- wsadmin
- serverStatus
condition: selection_parent and selection_child and not filter_admin_scripts
falsepositives:
- WebSphere administrative or deployment scripts invoked by the JVM through cmd.exe
- Application code that intentionally shells out for batch processing
level: high
id: 5330d205-887c-5324-8516-8f6463d0efd2
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0901
WebSphere Java Process Spawning Shell with Download or Recon Commands on Linux
WebSphere JVM spawning sh/bash with download, reverse-shell or recon commands, indicating possible exploitation of the application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Shell with Download or Recon Commands on Linux
description: Detects a WebSphere Application Server java process launching a Linux
shell whose command line contains download, reverse-shell or reconnaissance tooling.
Behavioural indicator of RCE exploitation of a public-facing Java application server,
independent of specific CVE.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains: /WebSphere/
ParentImage|endswith: /java
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
selection_cmd:
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- nc -e
- base64 -d
- whoami
- chmod +x
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Custom application code that shells out to curl or wget for integrations
- Monitoring or health-check scripts launched from within the JVM
level: high
id: a0bed31f-5fe0-5ce4-84a5-118c11f059c3
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0901
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0901
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs