# IBM products hit with 40+ critical vulnerabilities

Published: 2026-07-31 · Severity: high · Sectors: technology, financial-services, healthcare, government-national, defense, manufacturing
Canonical: https://vorant.io/reports/33e66fe8-03f6-5290-b731-6e526a0ee382/ibm-products-hit-with-40-critical-vulnerabilities

> CERT-FR advisory details multiple critical flaws in IBM AIX, DB2, QRadar, Sterling, and WebSphere enabling remote code execution and privilege escalation.

CERT-FR has published a comprehensive advisory documenting multiple vulnerabilities across IBM's product portfolio. The affected products include AIX, DB2 on Cloud Pak for Data, QRadar SIEM and applications, Sterling B2B Integrator, Sterling File Gateway, Sterling Control Center, Sterling External Authentication Server, and WebSphere Application Server. The vulnerabilities span a range of impact vectors including remote code execution, privilege escalation, denial of service, data confidentiality and integrity violations, authentication bypass, SSRF, XSS, CSRF, and SQL injection. Organizations running these products should prioritize patching according to the severity and exploitability of vulnerabilities affecting their specific deployed versions. The advisory references IBM's security bulletins dated July 23-30, 2026, which contain detailed remediation guidance and patches for each affected product line.

## Mentioned in this report

- Vulnerabilities: CVE-2018-10237, CVE-2018-16487, CVE-2020-13955, CVE-2020-13956, CVE-2020-8908, CVE-2021-22569, CVE-2021-22570, CVE-2021-23337 (templated), CVE-2021-47154, CVE-2022-22968, CVE-2022-39135, CVE-2023-22899, CVE-2023-5752, CVE-2024-12905 (poc), CVE-2024-23953, CVE-2024-29869, CVE-2024-38820, CVE-2024-38827, CVE-2024-45337, CVE-2024-52046, CVE-2024-6763, CVE-2025-11143, CVE-2025-11187, CVE-2025-12183, CVE-2025-12758, CVE-2025-13465, CVE-2025-14813, CVE-2025-15284, CVE-2025-15468, CVE-2025-15469, CVE-2025-21502, CVE-2025-22228, CVE-2025-27789, CVE-2025-47935, CVE-2025-47944, CVE-2025-48387, CVE-2025-48997, CVE-2025-56200, CVE-2025-5889, CVE-2025-59343

## Detection guidance (public sample)

### WebSphere Java Process Spawning Shell With Download or Reverse-Shell Commands on Linux

ATT&CK: T1190

A WebSphere or IBM Java server process spawning a shell that runs download, reverse-shell or encoded-payload commands, typical of post-exploitation after RCE in a public-facing IBM application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Shell With Download or Reverse-Shell Commands
  on Linux
description: Detects a WebSphere/IBM Java application server process spawning a shell
  that runs download, reverse-shell or encoded-payload commands. This is typical post-exploitation
  behaviour after remote code execution in a public-facing IBM application. Matches
  the parent/child relation and command patterns, not specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.persistence
- attack.t1505
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /WebSphere/
    - /websphere/
    - /IBM/
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - base64 -d
    - mkfifo
    - python -c
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrative or deployment scripts launched from the application server that use
  curl or wget for health checks
- Custom application start-up wrappers that download configuration
level: high
id: ae05b350-390a-547e-b99b-e56e7f18a687
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0958
```

### WebSphere or IBM Java Server Spawning Command Interpreter on Windows

ATT&CK: T1059

java.exe running from a WebSphere or IBM install path spawning cmd, PowerShell or LOLBins with reconnaissance or download commands, indicating web-shell or RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere or IBM Java Server Spawning Command Interpreter on Windows
description: Detects java.exe running from a WebSphere or IBM product directory spawning
  cmd.exe, PowerShell or common LOLBins with reconnaissance or download arguments.
  Indicates web shell or RCE exploitation of a public-facing IBM application server.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.persistence
- attack.t1505
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentImage|contains:
    - \WebSphere\
    - \IBM\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net group
    - ipconfig
    - systeminfo
    - Invoke-WebRequest
    - DownloadString
    - -urlcache
    - -enc
    - http
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrators running diagnostic commands through application server management
  scripts
- Product installers or updaters under an IBM directory that call cmd with http URLs
level: high
id: 2d3e57b8-5346-5cd0-8c05-757a82e4df84
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0958
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0958

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/33e66fe8-03f6-5290-b731-6e526a0ee382/ibm-products-hit-with-40-critical-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup