IBM products hit with 40+ critical vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory details multiple critical flaws in IBM AIX, DB2, QRadar, Sterling, and WebSphere enabling remote code execution and privilege escalation.
CERT-FR has published a comprehensive advisory documenting multiple vulnerabilities across IBM's product portfolio. The affected products include AIX, DB2 on Cloud Pak for Data, QRadar SIEM and applications, Sterling B2B Integrator, Sterling File Gateway, Sterling Control Center, Sterling External Authentication Server, and WebSphere Application Server. The vulnerabilities span a range of impact vectors including remote code execution, privilege escalation, denial of service, data confidentiality and integrity violations, authentication bypass, SSRF, XSS, CSRF, and SQL injection. Organizations running these products should prioritize patching according to the severity and exploitability of vulnerabilities affecting their specific deployed versions. The advisory references IBM's security bulletins dated July 23-30, 2026, which contain detailed remediation guidance and patches for each affected product line.
Mentioned in this report
Detection guidance
WebSphere Java Process Spawning Shell With Download or Reverse-Shell Commands on Linux
A WebSphere or IBM Java server process spawning a shell that runs download, reverse-shell or encoded-payload commands, typical of post-exploitation after RCE in a public-facing IBM application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Shell With Download or Reverse-Shell Commands
on Linux
description: Detects a WebSphere/IBM Java application server process spawning a shell
that runs download, reverse-shell or encoded-payload commands. This is typical post-exploitation
behaviour after remote code execution in a public-facing IBM application. Matches
the parent/child relation and command patterns, not specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.persistence
- attack.t1505
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- /WebSphere/
- /websphere/
- /IBM/
ParentImage|endswith: /java
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- base64 -d
- mkfifo
- python -c
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrative or deployment scripts launched from the application server that use
curl or wget for health checks
- Custom application start-up wrappers that download configuration
level: high
id: ae05b350-390a-547e-b99b-e56e7f18a687
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0958
WebSphere or IBM Java Server Spawning Command Interpreter on Windows
java.exe running from a WebSphere or IBM install path spawning cmd, PowerShell or LOLBins with reconnaissance or download commands, indicating web-shell or RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere or IBM Java Server Spawning Command Interpreter on Windows
description: Detects java.exe running from a WebSphere or IBM product directory spawning
cmd.exe, PowerShell or common LOLBins with reconnaissance or download arguments.
Indicates web shell or RCE exploitation of a public-facing IBM application server.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.persistence
- attack.t1505
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentImage|contains:
- \WebSphere\
- \IBM\
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
selection_cmd:
CommandLine|contains:
- whoami
- net user
- net group
- ipconfig
- systeminfo
- Invoke-WebRequest
- DownloadString
- -urlcache
- -enc
- http
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrators running diagnostic commands through application server management
scripts
- Product installers or updaters under an IBM directory that call cmd with http URLs
level: high
id: 2d3e57b8-5346-5cd0-8c05-757a82e4df84
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0958
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0958
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs