Multiple IBM product vulnerabilities enable RCE and privilege escalation
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Numerous vulnerabilities across IBM products allow remote code execution, privilege escalation, and denial of service; patches required immediately.
CERT-FR has published an advisory detailing multiple vulnerabilities affecting a broad range of IBM enterprise products, including AIX, Cognos Command Center, QRadar, Sterling B2B Integrator, Sterling File Gateway, Sterling Connect:Direct Web Services, Tivoli application management products, VIOS, and WebSphere Application Server Liberty. The vulnerabilities enable remote code execution, privilege escalation, denial of service, server-side request forgery (SSRF), cross-site scripting (XSS), and data integrity/confidentiality compromise across affected systems.
Vulnerable versions span multiple product lines with specific version thresholds identified for each: AIX 7.2 and 7.3 without latest security patches, Cognos Command Center versions prior to 12.2.5 FP1 IF4, QRadar AI Assistant prior to 2.1.0, QRadar SIEM 7.5.x prior to 7.5.0 UP15 IF05, Sterling products across versions 6.1.2.x through 6.2.2.x requiring specific patch levels, and WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 with temporary fixes or awaiting patches in Q3 2026.
Defenders must apply available patches immediately from IBM's security bulletins released 20–24 July 2026. Organizations running these products should prioritize patching based on their exposure and the specific impact vectors relevant to their deployments, particularly those exposed to network attack surfaces.
Mentioned in this report
Detection guidance
Java Application Server Spawning Shell With Download or Reverse-Shell Commands (Linux/AIX)
Java process (e.g. WebSphere Liberty, QRadar or Sterling components) spawning a shell that runs download, reverse-shell or staging commands, which is typical post-RCE behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Application Server Spawning Shell With Download or Reverse-Shell Commands
(Linux/AIX)
description: Detects a Java process such as an application server (WebSphere Liberty,
Sterling, QRadar components) spawning a shell whose command line contains download,
reverse-shell or staging primitives. This is typical post-exploitation behaviour
after RCE in a public-facing Java application. The IBM advisory gives no exploit
specifics, so this rule generalises on the parent/child relation and command content.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
selection_shell:
Image|endswith:
- /sh
- /bash
- /ksh
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- ncat
- base64 -d
- chmod +x
- chmod 777
- mkfifo
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Java-based build or deployment agents (e.g. Jenkins) running curl or wget from shell
steps
- Application health-check scripts launched by a Java service wrapper that call curl
level: medium
id: 8187db1e-bf14-587c-b124-71b21bdcbe6c
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0933
Java Process Spawning Windows Command Interpreter With Recon or Download Commands
java.exe spawning cmd/PowerShell with discovery, download or encoded-command arguments, indicating possible RCE in a Java-based enterprise product. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Windows Command Interpreter With Recon or Download Commands
description: Detects java.exe spawning cmd.exe or PowerShell with discovery, download
or encoded-command arguments. This indicates possible exploitation of a Java-based
enterprise application (WebSphere Liberty, Sterling, Cognos) for remote code execution.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_cmd:
CommandLine|contains:
- whoami
- net user
- net group
- certutil
- bitsadmin
- DownloadString
- DownloadFile
- Invoke-WebRequest
- ' -enc'
- FromBase64String
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based build or deployment tooling that invokes PowerShell download commands
- Administrative scripts launched through a Java scheduler or service wrapper
level: medium
id: 3c0f5a1a-af73-5846-8613-017d1a02c082
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0933
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0933
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs