Multiple IBM product vulnerabilities disclosed
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory covering 150+ CVEs across IBM AIX, Informix, WebSphere, QRadar, and PowerVM allowing remote code execution and privilege escalation.
CERT-FR has published a coordinated advisory covering multiple critical and high-severity vulnerabilities across IBM's product portfolio, including AIX 7.2 and 7.3, Informix Dynamic Server versions 12.10.x through 15.0.x, PowerVM VIOS 4.1, QRadar Log Source Management App versions before 7.0.17, and WebSphere products (Hybrid Edition 5.1, Remote Server 8.5/9.0/9.1, Service Registry and Repository 8.5). The vulnerabilities enable remote code execution, privilege escalation, denial of service, SQL injection, cross-site scripting, server-side request forgery, and policy bypass. The advisory consolidates 12 IBM security bulletins issued between August 14-20, 2026, referencing 150+ distinct CVEs. Defenders should prioritize patching affected systems according to IBM's security bulletins and verify compliance with current security patch levels for all listed products.
Mentioned in this report
Detection guidance
WebSphere Java Process Spawning Windows Command Shell
WebSphere JVM spawning cmd/PowerShell, consistent with exploitation of a public-facing WebSphere flaw (RCE) or a deployed web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Windows Command Shell
description: Detects a java.exe running from a WebSphere install path spawning a command
interpreter. Application servers rarely start interactive shells, so this is a useful
post-exploitation signal for RCE or web shell activity against WebSphere. The advisory
describes the vulnerabilities but gives no specific payloads, so the rule keys on
the parent/child relation.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: \WebSphere\
ParentImage|endswith: \java.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
condition: selection
falsepositives:
- WebSphere administrative or deployment scripts that invoke cmd.exe from the application
server JVM
- Backup or housekeeping jobs started by the WebSphere scheduler
level: medium
id: c3753586-507f-5781-a068-a4845f316983
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1067
WebSphere Java Process Spawning Unix Shell
WebSphere JVM on Linux spawning a shell, indicating possible RCE exploitation or a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Unix Shell
description: Detects a java process running from a WebSphere path spawning a Unix
shell. This is a behavioural signal for RCE exploitation or web shell use on WebSphere
servers, which the advisory lists as affected.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: /WebSphere/
ParentImage|endswith: /java
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
- /zsh
condition: selection
falsepositives:
- WebSphere start/stop or wsadmin wrapper scripts launched from the JVM
- Application-specific health-check scripts run by the server
level: medium
id: 364b7020-0468-55a6-a13d-b6f63d1bcc1e
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1067
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1067
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs