# Multiple IBM product vulnerabilities disclosed

Published: 2026-08-21 · Severity: high · Sectors: technology, government-national, financial-services, defense
Canonical: https://vorant.io/reports/97a09ec9-2816-5551-95c8-0d56a265b9d6/multiple-ibm-product-vulnerabilities-disclosed

> CERT-FR advisory covering 150+ CVEs across IBM AIX, Informix, WebSphere, QRadar, and PowerVM allowing remote code execution and privilege escalation.

CERT-FR has published a coordinated advisory covering multiple critical and high-severity vulnerabilities across IBM's product portfolio, including AIX 7.2 and 7.3, Informix Dynamic Server versions 12.10.x through 15.0.x, PowerVM VIOS 4.1, QRadar Log Source Management App versions before 7.0.17, and WebSphere products (Hybrid Edition 5.1, Remote Server 8.5/9.0/9.1, Service Registry and Repository 8.5). The vulnerabilities enable remote code execution, privilege escalation, denial of service, SQL injection, cross-site scripting, server-side request forgery, and policy bypass. The advisory consolidates 12 IBM security bulletins issued between August 14-20, 2026, referencing 150+ distinct CVEs. Defenders should prioritize patching affected systems according to IBM's security bulletins and verify compliance with current security patch levels for all listed products.

## Mentioned in this report

- Vulnerabilities: CVE-2023-44487 (KEV), CVE-2025-12817, CVE-2025-12818, CVE-2025-15649, CVE-2026-10842, CVE-2026-12087, CVE-2026-14446, CVE-2026-14512, CVE-2026-14515, CVE-2026-14525, CVE-2026-14528, CVE-2026-14529, CVE-2026-14970, CVE-2026-14974, CVE-2026-15061, CVE-2026-15065, CVE-2026-15068, CVE-2026-15078, CVE-2026-16184, CVE-2026-16243, CVE-2026-16439, CVE-2026-16441, CVE-2026-16656, CVE-2026-16686, CVE-2026-16690, CVE-2026-16703, CVE-2026-16706, CVE-2026-16814, CVE-2026-16816, CVE-2026-16817, CVE-2026-16818, CVE-2026-16819, CVE-2026-16821, CVE-2026-16822, CVE-2026-16824, CVE-2026-16825, CVE-2026-16827, CVE-2026-16829, CVE-2026-16831, CVE-2026-16833

## Detection guidance (public sample)

### WebSphere Java Process Spawning Windows Command Shell

ATT&CK: T1059

WebSphere JVM spawning cmd/PowerShell, consistent with exploitation of a public-facing WebSphere flaw (RCE) or a deployed web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Windows Command Shell
description: Detects a java.exe running from a WebSphere install path spawning a command
  interpreter. Application servers rarely start interactive shells, so this is a useful
  post-exploitation signal for RCE or web shell activity against WebSphere. The advisory
  describes the vulnerabilities but gives no specific payloads, so the rule keys on
  the parent/child relation.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: \WebSphere\
    ParentImage|endswith: \java.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  condition: selection
falsepositives:
- WebSphere administrative or deployment scripts that invoke cmd.exe from the application
  server JVM
- Backup or housekeeping jobs started by the WebSphere scheduler
level: medium
id: c3753586-507f-5781-a068-a4845f316983
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1067
```

### WebSphere Java Process Spawning Unix Shell

ATT&CK: T1059.004

WebSphere JVM on Linux spawning a shell, indicating possible RCE exploitation or a web shell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Unix Shell
description: Detects a java process running from a WebSphere path spawning a Unix
  shell. This is a behavioural signal for RCE exploitation or web shell use on WebSphere
  servers, which the advisory lists as affected.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: /WebSphere/
    ParentImage|endswith: /java
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /zsh
  condition: selection
falsepositives:
- WebSphere start/stop or wsadmin wrapper scripts launched from the JVM
- Application-specific health-check scripts run by the server
level: medium
id: 364b7020-0468-55a6-a13d-b6f63d1bcc1e
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1067
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1067

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/97a09ec9-2816-5551-95c8-0d56a265b9d6/multiple-ibm-product-vulnerabilities-disclosed.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup