Multiple vulnerabilities across IBM enterprise products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
IBM security bulletin addresses over 150 CVEs across Db2, QRadar, WebSphere, Sterling, and Informix; patch immediately.
CERT-FR released a comprehensive security advisory covering multiple vulnerabilities affecting a broad range of IBM enterprise products published in July-August 2026. The affected products span database platforms (Db2, Informix Dynamic Server), security and monitoring tools (QRadar SIEM), application servers (WebSphere Application Server variants), and B2B integration platforms (Sterling B2B Integrator, Sterling File Gateway, Sterling Order Management, Sterling Control Center). Documented vulnerabilities enable remote code execution, privilege escalation, denial of service, data integrity and confidentiality compromise, and security policy bypass through mechanisms including deserialization flaws, cross-site scripting, server-side request forgery, and cross-site request forgery. The advisory provides version information for vulnerable and patched releases, with IBM issuing coordinated security bulletins across multiple product lines. Defenders must prioritize patching based on their deployed product inventory, particularly systems running QRadar SIEM, WebSphere, and Sterling platforms which are critical to enterprise operations.
Mentioned in this report
Detection guidance
IBM WebSphere or Sterling Java Process Spawning Windows Shell or LOLBin
Java process running from an IBM WebSphere or Sterling install path spawning cmd, PowerShell or common download and exec LOLBins, which is typical post-exploitation of deserialization or RCE flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IBM WebSphere or Sterling Java Process Spawning Windows Shell or LOLBin
description: Detects a java.exe process running from an IBM WebSphere or Sterling
install path that spawns cmd, PowerShell or common download and execute LOLBins.
This is a typical post-exploitation pattern for deserialization or RCE flaws in
IBM application servers and B2B platforms. Generalises on the parent/child relation
rather than any specific exploit string.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentImage|contains:
- \WebSphere\
- \Sterling\
- \IBM\
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \whoami.exe
condition: selection_parent and selection_child
falsepositives:
- Administrative wsadmin or deployment scripts launched by the application server
that invoke cmd.exe
- Sterling B2B Integrator custom business processes that intentionally run command-line
adapters
level: medium
id: c969ab3b-0956-5ad3-8c21-85aea99fd220
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0986
IBM Java Application Server Spawning Linux Shell with Download or Reverse-Shell Commands
Java process from an IBM install path (WebSphere, Sterling, QRadar) spawning sh/bash with download, encoding or reverse-shell command lines after exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IBM Java Application Server Spawning Linux Shell with Download or Reverse-Shell
Commands
description: Detects a Java process running from an IBM install path (WebSphere, Sterling,
QRadar and similar) that spawns a shell whose command line downloads or decodes
content or opens a reverse shell. Indicates likely exploitation of a public-facing
IBM application via deserialization or code injection.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentImage|contains: /IBM/
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- base64 -d
- /dev/tcp/
- nc -e
- mkfifo
- chmod +x
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Product installers or fix-pack scripts that download packages via curl or wget under
a Java launcher
- Custom Sterling business process scripts that fetch files with curl
level: high
id: 5831174a-9a06-5b01-9f05-b9dc1135f756
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0986
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0986
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs