CERT-FR flags multiple IBM product vulnerabilities
CERT-FR advisory lists dozens of CVEs across IBM Db2, QRadar, and Sterling products enabling RCE, DoS, SSRF, and data exposure; patches available.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited in the wild.
CERT-FR published an advisory consolidating multiple vulnerabilities disclosed by IBM across several product lines: Db2 Bridge, Db2 Developer Extension, QRadar Hub, QRadar SIEM, QRadar SOAR, Sterling B2B Integrator, and Sterling File Gateway. The affected versions span Db2 Bridge prior to 1.1.5.3, Db2 Developer Extension prior to 1.2.1, QRadar Hub prior to 3.9.2, QRadar SIEM prior to 7.6.0.6, QRadar SOAR prior to 51.0.11.2, and various pre-patch builds of Sterling B2B Integrator and Sterling File Gateway (6.2.1.x and 6.2.2.x branches).
The vulnerabilities collectively cover a wide range of impacts including remote arbitrary code execution, remote denial of service, loss of data confidentiality, security policy bypass, and server-side request forgery (SSRF). The advisory references over sixty CVE identifiers spanning 2022 through 2026, with no single vulnerability singled out as actively exploited; the bulletin does not indicate in-the-wild exploitation.
Defenders running any of the listed IBM products should prioritize patching to the fixed versions referenced in IBM's own security bulletins (issued between 23 and 28 October 2026). Given the breadth of products (Db2 data integration tooling, QRadar SIEM/SOAR security operations platforms, and Sterling B2B/file-transfer gateways), organizations should treat this as a routine but broad patch-management action, verifying exposure of QRadar and Sterling instances to untrusted networks given the RCE and SSRF risk classes mentioned.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1433
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs