Multiple vulnerabilities in IBM products
CERT-FR advises of multiple vulnerabilities across IBM products enabling remote code execution, privilege elevation, and denial of service.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-11953 as exploited in the wild.
CERT-FR has published a security advisory covering multiple vulnerabilities discovered across a range of IBM enterprise products. The affected products include Analyst Workflow, Cloud Pak for Security, Cognos Analytics Mobile, QRadar SIEM, QRadar Suite Software, Sterling Control Center, and Tivoli Monitoring. The vulnerabilities enable attackers to achieve remote code execution, privilege elevation, denial of service, data confidentiality and integrity compromise, security policy bypass, server-side request forgery, cross-site scripting, and SQL injection. Specific affected versions are identified: Analyst Workflow before 3.1.0, Cloud Pak for Security before 1.11.11.0, Cognos Analytics Mobile before 1.1.26, QRadar SIEM 7.5.0 before UP15 IF03, QRadar Suite Software before 1.11.11.0, Sterling Control Center 6.3.1.0, 6.4.1.0, and 6.4.2.0 (without specified iFix patches), and Tivoli Monitoring without the latest security patch. Defenders must consult IBM's security bulletins to obtain and apply the appropriate patches for their deployed versions and products.
Mentioned in this report
Detection guidance
IBM Java Application Spawning Command Shell or Scripting Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
A Java process running from an IBM install path (Tivoli Monitoring, Sterling Control Center and similar) spawns cmd, PowerShell, or a script host, a pattern consistent with remote code execution through a public-facing application flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IBM Java Application Spawning Command Shell or Scripting Interpreter
id: 8cb6a1f2-32d3-50a4-a3c1-5521990fd2d9
status: experimental
description: Detects java.exe running from an IBM installation directory (e.g. Tivoli
Monitoring, Sterling Control Center) spawning a command shell or script interpreter.
This is consistent with post-exploitation after remote code execution in a Java-based
IBM product. The advisory gives no exploit specifics, so the rule keys on the generic
parent/child pattern.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: \IBM\
ParentImage|endswith: \java.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
filter_version_checks:
CommandLine|contains:
- cinfo.exe
- itmcmd
condition: selection and not filter_version_checks
falsepositives:
- Tivoli Monitoring situations or agent scripts that legitimately launch cmd.exe from
the IBM Java runtime
- Product installers or patch routines running batch files through the bundled Java
level: medium
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0667
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0667
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs