# CERT-FR lists multiple IBM product flaws

Published: 2026-10-23 · Severity: high · Sectors: Technology, Government (National), Financial Services
Canonical: https://vorant.io/reports/474b1696-c2be-5d12-acc8-32db3ec6052e/cert-fr-lists-multiple-ibm-product-flaws

> CERT-FR advisory details dozens of vulnerabilities across AIX, Cognos Analytics, Db2, QRadar apps, Sterling, and WebSphere eXtreme Scale needing patching.

CERT-FR has published a consolidated advisory covering multiple IBM security bulletins issued between October 15 and October 23, 2026, affecting a wide range of IBM products: AIX (7.2/7.3) and VIOS lacking NTP and tmux patches, Cognos Analytics (12.0.x and 12.1.x), Db2 1.2.x, several QRadar components (App SDK, Pulse App, Use Case Manager App, Log Management AQL Plugin, SOAR QRadar Plugin App), the Sterling B2B Integrator/File Gateway/B2 family, and WebSphere eXtreme Scale. The vulnerabilities span a broad risk spectrum including remote code execution, privilege escalation, remote denial of service, data integrity and confidentiality compromise, security bypass, SSRF, and indirect remote code injection (XSS).

No evidence of active exploitation is cited in the advisory; it is a routine patch notification referencing eleven separate IBM security bulletins and well over one hundred CVE identifiers, including some long-standing third-party library issues (e.g., CVE-2016-1000240, CVE-2020-11023, CVE-2023-44487 HTTP/2 Rapid Reset, CVE-2023-28155 SSRF in the request npm package) as well as numerous newly assigned 2026 CVEs specific to IBM components. Defenders running any of the listed IBM products should prioritize patching based on exposure, particularly internet-facing Sterling B2B Integrator/File Gateway instances and QRadar deployments given their roles in security operations and file transfer, and AIX/VIOS systems missing the referenced NTP and tmux fixes.

Remediation requires applying the specific fixes referenced in each linked IBM security bulletin (fix packs, iFixes, or updated package versions) since no workarounds are provided. Given the volume and diversity of affected products, organizations should inventory their IBM software footprint against the listed version ranges and track patch rollout, especially for externally exposed services such as Sterling file transfer gateways and QRadar SOC tooling.

## Mentioned in this report

- Vulnerabilities: CVE-2016-1000240, CVE-2017-16026, CVE-2020-11023 (KEV), CVE-2021-23336, CVE-2021-23337 (templated), CVE-2022-24785, CVE-2022-42969, CVE-2023-28155, CVE-2023-44487 (KEV), CVE-2024-47535, CVE-2025-12635, CVE-2025-13465, CVE-2025-14009, CVE-2025-14813, CVE-2025-14915, CVE-2025-14923, CVE-2025-33123, CVE-2025-33147, CVE-2025-36076, CVE-2025-4517, CVE-2025-59375, CVE-2025-62718, CVE-2025-8885, CVE-2025-8916, CVE-2025-9095, CVE-2025-9096, CVE-2026-0636, CVE-2026-0846, CVE-2026-0847, CVE-2026-0848, CVE-2026-17495, CVE-2026-18149, CVE-2026-18540, CVE-2026-22007, CVE-2026-22013, CVE-2026-27903, CVE-2026-27904, CVE-2026-33230, CVE-2026-42027, CVE-2026-54530

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1378

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/474b1696-c2be-5d12-acc8-32db3ec6052e/cert-fr-lists-multiple-ibm-product-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup