# CERT-FR flags multiple IBM product vulnerabilities

Published: 2026-10-30 · Severity: severe · Sectors: Technology
Canonical: https://vorant.io/reports/2438901c-153b-59c4-94ec-2fc613f17b37/cert-fr-flags-multiple-ibm-product-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists dozens of CVEs across IBM Db2, QRadar, and Sterling products enabling RCE, DoS, SSRF, and data exposure; patches available.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1433

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited in the wild.

CERT-FR published an advisory consolidating multiple vulnerabilities disclosed by IBM across several product lines: Db2 Bridge, Db2 Developer Extension, QRadar Hub, QRadar SIEM, QRadar SOAR, Sterling B2B Integrator, and Sterling File Gateway. The affected versions span Db2 Bridge prior to 1.1.5.3, Db2 Developer Extension prior to 1.2.1, QRadar Hub prior to 3.9.2, QRadar SIEM prior to 7.6.0.6, QRadar SOAR prior to 51.0.11.2, and various pre-patch builds of Sterling B2B Integrator and Sterling File Gateway (6.2.1.x and 6.2.2.x branches).

The vulnerabilities collectively cover a wide range of impacts including remote arbitrary code execution, remote denial of service, loss of data confidentiality, security policy bypass, and server-side request forgery (SSRF). The advisory references over sixty CVE identifiers spanning 2022 through 2026, with no single vulnerability singled out as actively exploited; the bulletin does not indicate in-the-wild exploitation.

Defenders running any of the listed IBM products should prioritize patching to the fixed versions referenced in IBM's own security bulletins (issued between 23 and 28 October 2026). Given the breadth of products (Db2 data integration tooling, QRadar SIEM/SOAR security operations platforms, and Sterling B2B/file-transfer gateways), organizations should treat this as a routine but broad patch-management action, verifying exposure of QRadar and Sterling instances to untrusted networks given the RCE and SSRF risk classes mentioned.

## Mentioned in this report

- Vulnerabilities: CVE-2022-24785, CVE-2024-33663, CVE-2026-101898, CVE-2026-101900, CVE-2026-101901, CVE-2026-101902, CVE-2026-101903, CVE-2026-101904, CVE-2026-101905, CVE-2026-101906, CVE-2026-101907, CVE-2026-101908, CVE-2026-101909, CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, CVE-2026-102677, CVE-2026-104056, CVE-2026-109618 (KEV), CVE-2026-109619 (KEV), CVE-2026-17495, CVE-2026-19032, CVE-2026-41293, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-59888, CVE-2026-59889, CVE-2026-68497, CVE-2026-73581, CVE-2026-73633, CVE-2026-73634, CVE-2026-73635, CVE-2026-75973, CVE-2026-76183, CVE-2026-77310

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1433

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2438901c-153b-59c4-94ec-2fc613f17b37/cert-fr-flags-multiple-ibm-product-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup