# Multiple vulnerabilities in IBM products

Published: 2026-05-29 · Severity: high · Sectors: Technology, Financial Services, Government (National), Defense
Canonical: https://vorant.io/reports/5f087f1e-896a-5f9d-b9ef-64b9be28a135/multiple-vulnerabilities-in-ibm-products
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advises of multiple vulnerabilities across IBM products enabling remote code execution, privilege elevation, and denial of service.

Source: cert.ssi.gouv.fr — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0667

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2025-11953 as exploited in the wild.

CERT-FR has published a security advisory covering multiple vulnerabilities discovered across a range of IBM enterprise products. The affected products include Analyst Workflow, Cloud Pak for Security, Cognos Analytics Mobile, QRadar SIEM, QRadar Suite Software, Sterling Control Center, and Tivoli Monitoring. The vulnerabilities enable attackers to achieve remote code execution, privilege elevation, denial of service, data confidentiality and integrity compromise, security policy bypass, server-side request forgery, cross-site scripting, and SQL injection. Specific affected versions are identified: Analyst Workflow before 3.1.0, Cloud Pak for Security before 1.11.11.0, Cognos Analytics Mobile before 1.1.26, QRadar SIEM 7.5.0 before UP15 IF03, QRadar Suite Software before 1.11.11.0, Sterling Control Center 6.3.1.0, 6.4.1.0, and 6.4.2.0 (without specified iFix patches), and Tivoli Monitoring without the latest security patch. Defenders must consult IBM's security bulletins to obtain and apply the appropriate patches for their deployed versions and products.

## Mentioned in this report

- Vulnerabilities: CVE-2006-10002, CVE-2006-10003, CVE-2021-23337 (templated), CVE-2023-26132, CVE-2023-5764, CVE-2024-11079, CVE-2024-12797, CVE-2024-28102, CVE-2024-29371, CVE-2024-41073, CVE-2024-56462, CVE-2024-8775, CVE-2024-9902, CVE-2025-11953 (KEV), CVE-2025-12635, CVE-2025-12758, CVE-2025-12816, CVE-2025-13333, CVE-2025-13465, CVE-2025-14009, CVE-2025-14813, CVE-2025-15284, CVE-2025-22870, CVE-2025-40252, CVE-2025-41248, CVE-2025-41249, CVE-2025-5187, CVE-2025-53643, CVE-2025-58754, CVE-2025-59471, CVE-2025-59472, CVE-2025-6176, CVE-2025-62718, CVE-2025-64718, CVE-2025-64756, CVE-2025-6545, CVE-2025-6547, CVE-2025-65945, CVE-2025-66030, CVE-2025-66031

## Detection guidance (public sample)

### IBM Java Application Spawning Command Shell or Scripting Interpreter

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

A Java process running from an IBM install path (Tivoli Monitoring, Sterling Control Center and similar) spawns cmd, PowerShell, or a script host, a pattern consistent with remote code execution through a public-facing application flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IBM Java Application Spawning Command Shell or Scripting Interpreter
id: 8cb6a1f2-32d3-50a4-a3c1-5521990fd2d9
status: experimental
description: Detects java.exe running from an IBM installation directory (e.g. Tivoli
  Monitoring, Sterling Control Center) spawning a command shell or script interpreter.
  This is consistent with post-exploitation after remote code execution in a Java-based
  IBM product. The advisory gives no exploit specifics, so the rule keys on the generic
  parent/child pattern.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: \IBM\
    ParentImage|endswith: \java.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  filter_version_checks:
    CommandLine|contains:
    - cinfo.exe
    - itmcmd
  condition: selection and not filter_version_checks
falsepositives:
- Tivoli Monitoring situations or agent scripts that legitimately launch cmd.exe from
  the IBM Java runtime
- Product installers or patch routines running batch files through the bundled Java
level: medium
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0667
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0667

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5f087f1e-896a-5f9d-b9ef-64b9be28a135/multiple-vulnerabilities-in-ibm-products.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup