Multiple vulnerabilities in IBM products
Multiple vulnerabilities across IBM products enable remote code execution, denial of service, and data compromise; patches available.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published a security advisory covering multiple vulnerabilities affecting IBM products, issued between September 21 and September 24, 2026. The affected products include AIX 7.3, Db2 Genius Hub & Agentics, QRadar AI Assistant, QRadar App SDK, QRadar Log Source Management App, Security QRadar Log Management AQL Plugin, Sterling Control Center, Sterling Secure Proxy, WebSphere Application Server Liberty, and WebSphere Hybrid Edition. The vulnerabilities enable a range of attack outcomes including remote code execution, denial of service, data confidentiality breaches, integrity violations, security policy bypass, server-side request forgery (SSRF), cross-site scripting (XSS), and cross-site request forgery (CSRF). Affected versions span from older releases to recent versions, with specific patch identifiers provided for each product family. IBM has released security bulletins with remediation guidance for each affected product line.
Mentioned in this report
Detection guidance
WebSphere Liberty Java Process Spawning Windows Shell or LOLBin
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the WebSphere Liberty JVM spawning cmd/PowerShell or download LOLBins, a typical post-exploitation pattern after RCE against a public-facing IBM application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Liberty Java Process Spawning Windows Shell or LOLBin
description: Detects the WebSphere Liberty JVM (ws-server.jar / wlp directory) spawning
a command interpreter or download utility. Generalised post-exploitation behaviour
for RCE in public-facing IBM application servers, not tied to a specific CVE or
payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- ws-server.jar
- \wlp\
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection_parent and selection_child
falsepositives:
- Administrative or deployment scripts invoked from within a Liberty application that
legitimately shell out
- Health-check or monitoring applications deployed on Liberty that call cmd.exe
level: high
id: 4d61e415-6211-59a1-80c0-c0070d830139
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1233
WebSphere Liberty Java Process Spawning Shell With Download or Reverse Shell Syntax
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the WebSphere Liberty JVM on Linux/AIX spawning a shell that runs download, reverse-shell or decode commands, indicating likely RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Liberty Java Process Spawning Shell With Download or Reverse Shell
Syntax
description: Detects a Java process running WebSphere Liberty (ws-server.jar or a
/wlp/ path) spawning sh/bash with curl, wget, /dev/tcp, base64 decode or mkfifo
in the command line. Behavioural indicator of exploitation of a public-facing IBM
application server.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentCommandLine|contains:
- ws-server.jar
- /wlp/
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- base64 -d
- mkfifo
condition: selection_parent and selection_child
falsepositives:
- Deployed applications that legitimately call curl or wget through a shell for integration
tasks
- Administrative automation run from a Liberty-hosted management application
level: high
id: 185f9569-5410-576f-828f-680b9c546999
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1233
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1233
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs