IBM Patches Multiple AIX, QRadar, Sterling Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advises patching numerous IBM product vulnerabilities, including RCE and privilege escalation flaws, across AIX, QRadar, Sterling, and other software.
CERT-FR has published a consolidated advisory covering a large batch of vulnerabilities affecting multiple IBM product lines, based on eleven IBM security bulletins issued between mid-October and late October 2026. Affected products include AIX (7.2/7.3, missing ntp.rte and tmux.rte fixes), VIOS 4.1, Cognos Analytics, Db2, several QRadar components (App SDK, Pulse App, Use Case Manager App, Log Management AQL Plugin, SOAR QRadar Plugin App), the Sterling B2B Integrator/File Gateway family, and WebSphere eXtreme Scale. The combined risk set spans remote code execution, privilege escalation, remote denial of service, data integrity and confidentiality compromise, security bypass, SSRF, and cross-site scripting (XSS).
The advisory does not indicate any confirmed in-the-wild exploitation; it is a standard patch-availability notice aggregating IBM's own disclosures, some of which reference older, previously disclosed CVEs (e.g., CVE-2023-44487 HTTP/2 Rapid Reset, CVE-2016-1000240, CVE-2017-16026) bundled alongside newer 2025/2026 CVEs affecting the listed products. No specific exploit code, threat actor, or malware is referenced in the bulletin.
Defenders running any of the listed IBM products should consult the referenced IBM security bulletins for the specific CVE-to-product mapping and apply the corresponding fixes (e.g., ntp.rte.7.2/7.3 and tmux.rte.3.5.1.1 for AIX/VIOS, Cognos Analytics 12.0.4 FP3 / 12.1.3 FP2, Db2 1.2.1, QRadar app updates, Sterling 6.2.1.3/6.2.2.2, and WebSphere eXtreme Scale 8.6.2.2 with PH73641 iFix). Given the volume of distinct products and the mix of severities (including several RCE and privilege-escalation issues), patching should be prioritized by exposure — internet-facing Sterling File Gateway/B2B Integrator instances and QRadar components used for SOC operations warrant particular attention.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1378
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,072 reports from 142 sources, 533 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs