# Multiple vulnerabilities across IBM enterprise products

Published: 2026-08-07 · Severity: elevated · Sectors: financial-services, government-national, defense, technology
Canonical: https://vorant.io/reports/3e60db2e-5c21-5c02-9f9d-5d77fe7628dc/multiple-vulnerabilities-across-ibm-enterprise-products

> IBM security bulletin addresses over 150 CVEs across Db2, QRadar, WebSphere, Sterling, and Informix; patch immediately.

CERT-FR released a comprehensive security advisory covering multiple vulnerabilities affecting a broad range of IBM enterprise products published in July-August 2026. The affected products span database platforms (Db2, Informix Dynamic Server), security and monitoring tools (QRadar SIEM), application servers (WebSphere Application Server variants), and B2B integration platforms (Sterling B2B Integrator, Sterling File Gateway, Sterling Order Management, Sterling Control Center). Documented vulnerabilities enable remote code execution, privilege escalation, denial of service, data integrity and confidentiality compromise, and security policy bypass through mechanisms including deserialization flaws, cross-site scripting, server-side request forgery, and cross-site request forgery. The advisory provides version information for vulnerable and patched releases, with IBM issuing coordinated security bulletins across multiple product lines. Defenders must prioritize patching based on their deployed product inventory, particularly systems running QRadar SIEM, WebSphere, and Sterling platforms which are critical to enterprise operations.

## Mentioned in this report

- Vulnerabilities: CVE-2023-53781, CVE-2024-34459, CVE-2024-4741, CVE-2025-13755, CVE-2025-14813, CVE-2025-21858, CVE-2025-36372, CVE-2025-39981, CVE-2025-53906, CVE-2025-68161, CVE-2025-68183, CVE-2025-68347, CVE-2025-68366, CVE-2025-71116, CVE-2026-10025, CVE-2026-10109, CVE-2026-10535, CVE-2026-10695, CVE-2026-10842, CVE-2026-11897, CVE-2026-11906, CVE-2026-13367, CVE-2026-13476, CVE-2026-14446, CVE-2026-14512, CVE-2026-14515, CVE-2026-14528, CVE-2026-14529, CVE-2026-14974, CVE-2026-14976, CVE-2026-14980, CVE-2026-14981, CVE-2026-15057, CVE-2026-15064, CVE-2026-15280, CVE-2026-15325, CVE-2026-15328, CVE-2026-16184, CVE-2026-16192, CVE-2026-16243

## Detection guidance (public sample)

### IBM WebSphere or Sterling Java Process Spawning Windows Shell or LOLBin

ATT&CK: T1059

Java process running from an IBM WebSphere or Sterling install path spawning cmd, PowerShell or common download and exec LOLBins, which is typical post-exploitation of deserialization or RCE flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IBM WebSphere or Sterling Java Process Spawning Windows Shell or LOLBin
description: Detects a java.exe process running from an IBM WebSphere or Sterling
  install path that spawns cmd, PowerShell or common download and execute LOLBins.
  This is a typical post-exploitation pattern for deserialization or RCE flaws in
  IBM application servers and B2B platforms. Generalises on the parent/child relation
  rather than any specific exploit string.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentImage|contains:
    - \WebSphere\
    - \Sterling\
    - \IBM\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \whoami.exe
  condition: selection_parent and selection_child
falsepositives:
- Administrative wsadmin or deployment scripts launched by the application server
  that invoke cmd.exe
- Sterling B2B Integrator custom business processes that intentionally run command-line
  adapters
level: medium
id: c969ab3b-0956-5ad3-8c21-85aea99fd220
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0986
```

### IBM Java Application Server Spawning Linux Shell with Download or Reverse-Shell Commands

ATT&CK: T1190

Java process from an IBM install path (WebSphere, Sterling, QRadar) spawning sh/bash with download, encoding or reverse-shell command lines after exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IBM Java Application Server Spawning Linux Shell with Download or Reverse-Shell
  Commands
description: Detects a Java process running from an IBM install path (WebSphere, Sterling,
  QRadar and similar) that spawns a shell whose command line downloads or decodes
  content or opens a reverse shell. Indicates likely exploitation of a public-facing
  IBM application via deserialization or code injection.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentImage|contains: /IBM/
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - base64 -d
    - /dev/tcp/
    - nc -e
    - mkfifo
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Product installers or fix-pack scripts that download packages via curl or wget under
  a Java launcher
- Custom Sterling business process scripts that fetch files with curl
level: high
id: 5831174a-9a06-5b01-9f05-b9dc1135f756
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0986
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0986

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3e60db2e-5c21-5c02-9f9d-5d77fe7628dc/multiple-vulnerabilities-across-ibm-enterprise-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup