# Multiple vulnerabilities across IBM product portfolio

Published: 2026-07-17 · Severity: high · Sectors: technology, financial-services, government-national, defense
Canonical: https://vorant.io/reports/058cade7-fadb-5330-8ec5-829c341ab48d/multiple-vulnerabilities-across-ibm-product-portfolio

> CERT-FR advisory covering 150+ CVEs affecting IBM databases, QRadar, WebSphere, and Sterling products enabling remote code execution and privilege escalation.

CERT-FR has published a coordinated advisory documenting multiple vulnerabilities across a wide range of IBM enterprise products. The affected portfolio includes Db2 database versions, QRadar security analytics platforms, WebSphere Application Server, and Sterling file-transfer and secure-proxy solutions. The vulnerabilities span a range of impact categories including remote code execution, privilege escalation, denial of service, server-side request forgery, cross-site scripting, and data confidentiality and integrity violations. The advisory references over 150 CVE identifiers published between 2020 and 2026, with the most recent batch disclosed in July 2026. Defenders should prioritize patching based on which IBM products are deployed in their environment, cross-referencing the specific version ranges listed against their inventory. IBM has published separate security bulletins for each affected product line with version-specific remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2020-28500, CVE-2020-7760, CVE-2020-8203, CVE-2021-23337 (templated), CVE-2022-21704, CVE-2022-24785, CVE-2022-31129, CVE-2022-40896, CVE-2023-32681, CVE-2023-37920, CVE-2023-42282, CVE-2023-43804, CVE-2023-45803, CVE-2024-29415, CVE-2024-35195, CVE-2024-3651, CVE-2024-37891, CVE-2024-39689, CVE-2024-45337, CVE-2024-47081, CVE-2024-52804, CVE-2024-6485, CVE-2025-11143, CVE-2025-13465, CVE-2025-14505, CVE-2025-15284, CVE-2025-15599, CVE-2025-23165, CVE-2025-47287, CVE-2025-50181, CVE-2025-59436, CVE-2025-59437, CVE-2025-59471, CVE-2025-59472, CVE-2025-62718, CVE-2025-6493, CVE-2025-66221, CVE-2025-66418, CVE-2025-66471, CVE-2025-67724

## Detection guidance (public sample)

### WebSphere Java Process Spawning Command Shell or Scripting Interpreter on Windows

ATT&CK: T1190

WebSphere Application Server's java.exe spawning cmd, PowerShell or other script hosts, which is typical post-exploitation of an RCE flaw in a public-facing app server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Command Shell or Scripting Interpreter on Windows
description: Detects the IBM WebSphere Application Server JVM spawning a command interpreter
  or script host. Exploiting RCE flaws in public-facing Java application servers (T1190)
  typically yields shell/script child processes (T1059) of the server process. Generalises
  on the parent/child relation, not on any specific CVE or payload.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \WebSphere\
    ParentImage|endswith: \java.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_admin_scripts:
    CommandLine|contains:
    - startServer
    - stopServer
    - wsadmin
    - serverStatus
  condition: selection_parent and selection_child and not filter_admin_scripts
falsepositives:
- WebSphere administrative or deployment scripts invoked by the JVM through cmd.exe
- Application code that intentionally shells out for batch processing
level: high
id: 5330d205-887c-5324-8516-8f6463d0efd2
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0901
```

### WebSphere Java Process Spawning Shell with Download or Recon Commands on Linux

ATT&CK: T1059

WebSphere JVM spawning sh/bash with download, reverse-shell or recon commands, indicating possible exploitation of the application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Shell with Download or Recon Commands on Linux
description: Detects a WebSphere Application Server java process launching a Linux
  shell whose command line contains download, reverse-shell or reconnaissance tooling.
  Behavioural indicator of RCE exploitation of a public-facing Java application server,
  independent of specific CVE.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: /WebSphere/
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
  selection_cmd:
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - nc -e
    - base64 -d
    - whoami
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Custom application code that shells out to curl or wget for integrations
- Monitoring or health-check scripts launched from within the JVM
level: high
id: a0bed31f-5fe0-5ce4-84a5-118c11f059c3
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0901
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0901

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/058cade7-fadb-5330-8ec5-829c341ab48d/multiple-vulnerabilities-across-ibm-product-portfolio.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup