# Multiple vulnerabilities in IBM products

Published: 2026-07-03 · Severity: high · Sectors: Technology, Financial Services, Energy, Healthcare, Manufacturing, Government (National)
Canonical: https://vorant.io/reports/39c7d01a-55d4-5070-99ef-6427cb0c52e8/multiple-vulnerabilities-in-ibm-products
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR reports multiple vulnerabilities in IBM products including Db2, WebSphere Application Server, and QRadar enabling remote code execution and privilege escalation.

Source: cert.ssi.gouv.fr — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0834

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: A public exploit is recorded for CVE-2021-23337 (templated); no exploitation in the wild is recorded.

CERT-FR has published an advisory covering multiple vulnerabilities across several IBM product lines. The affected products include Db2 Big SQL on IBM Software Hub (versions before 5.4), Db2 Genius Hub (before 1.1.3), SOAR QRadar Plugin App (before 5.6.5), WebSphere Application Server Liberty (before 26.0.0.8), WebSphere Application Server 8.x (before 8.5.5.31) and 9.x (before 9.0.5.29), and WebSphere Remote Server 8.5.x and 9.x branches. The vulnerabilities enable multiple attack vectors including remote code execution, privilege escalation, denial of service, server-side request forgery (SSRF), cross-site scripting (XSS), data integrity compromise, and confidentiality breaches. IBM has released security bulletins addressing these issues across multiple releases dated June through July 2026. Defenders should prioritize patching affected versions according to IBM's vendor security bulletins.

## Mentioned in this report

- Vulnerabilities: CVE-2021-23337 (templated), CVE-2021-3572, CVE-2023-24056, CVE-2024-12086, CVE-2024-24786, CVE-2024-25260, CVE-2024-29869, CVE-2024-7531, CVE-2025-12183, CVE-2025-13465, CVE-2025-1371, CVE-2025-13755, CVE-2025-1376, CVE-2025-1377, CVE-2025-14688, CVE-2025-15284, CVE-2025-1795, CVE-2025-36122, CVE-2025-4516, CVE-2025-47914, CVE-2025-48924, CVE-2025-50181, CVE-2025-50182, CVE-2025-58181, CVE-2025-6069, CVE-2025-62718, CVE-2025-64718, CVE-2025-67735, CVE-2025-68161, CVE-2025-68428, CVE-2025-68470, CVE-2025-69873, CVE-2025-8291, CVE-2026-10845, CVE-2026-10852, CVE-2026-11383, CVE-2026-11536, CVE-2026-11541, CVE-2026-11546, CVE-2026-11594

## Detection guidance (public sample)

### WebSphere or Liberty Java Process Spawning Shell or Recon/Download Utility (Windows)

ATT&CK: T1059

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects the WebSphere/Liberty JVM spawning command interpreters or recon/download LOLBins, a typical post-exploitation pattern after RCE against an IBM application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere or Liberty Java Process Spawning Shell or Recon/Download Utility
  (Windows)
description: Detects the IBM WebSphere/Liberty JVM spawning command interpreters or
  recon/download utilities. Typical behaviour after successful remote code execution
  or webshell deployment on an IBM application server. Generalises on the parent/child
  relation, not on any specific CVE payload.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentImage|contains:
    - \WebSphere\
    - \Liberty\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
  condition: selection_parent and selection_child
falsepositives:
- Administrative or deployment scripts launched by the WebSphere JVM such as wsadmin
  or custom application hooks
- Applications hosted on WebSphere that legitimately shell out to cmd.exe for batch
  jobs
level: medium
id: 1c0bb964-40e5-5911-beb9-e51507d670db
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0834
```

### WebSphere or Liberty Java Process Spawning Shell (Linux)

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects a WebSphere/Liberty JVM on Linux spawning a shell or download/recon utility, indicating possible exploitation of the application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere or Liberty Java Process Spawning Shell (Linux)
description: Detects a Java process belonging to IBM WebSphere/Liberty spawning a
  shell or download/recon utility on Linux, indicating possible exploitation of a
  public-facing application server (RCE) or webshell activity.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains:
    - websphere
    - wlp
    - ws-server.jar
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
    - /nc
    - /whoami
  condition: selection_parent and selection_child
falsepositives:
- Hosted applications that legitimately invoke shell scripts from the JVM
- Administrative start/stop or backup hooks invoked by the server process
level: medium
id: 905afcf6-0922-5974-b849-caba1db13592
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0834
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0834

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/39c7d01a-55d4-5070-99ef-6427cb0c52e8/multiple-vulnerabilities-in-ibm-products.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup