# Multiple vulnerabilities in IBM products

Published: 2026-09-25 · Severity: elevated · Sectors: Technology, Financial Services, Government (National)
Canonical: https://vorant.io/reports/a1d936c1-d3b7-5581-ac96-7d8f4da3c3ad/multiple-vulnerabilities-in-ibm-products
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Multiple vulnerabilities across IBM products enable remote code execution, denial of service, and data compromise; patches available.

Source: cert.ssi.gouv.fr — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1233

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has published a security advisory covering multiple vulnerabilities affecting IBM products, issued between September 21 and September 24, 2026. The affected products include AIX 7.3, Db2 Genius Hub & Agentics, QRadar AI Assistant, QRadar App SDK, QRadar Log Source Management App, Security QRadar Log Management AQL Plugin, Sterling Control Center, Sterling Secure Proxy, WebSphere Application Server Liberty, and WebSphere Hybrid Edition. The vulnerabilities enable a range of attack outcomes including remote code execution, denial of service, data confidentiality breaches, integrity violations, security policy bypass, server-side request forgery (SSRF), cross-site scripting (XSS), and cross-site request forgery (CSRF). Affected versions span from older releases to recent versions, with specific patch identifiers provided for each product family. IBM has released security bulletins with remediation guidance for each affected product line.

## Mentioned in this report

- Vulnerabilities: CVE-2018-1109, CVE-2018-1313, CVE-2018-14040, CVE-2018-14041, CVE-2018-14042, CVE-2018-14732, CVE-2019-8331, CVE-2020-7598, CVE-2021-20066, CVE-2021-23382, CVE-2021-44906, CVE-2022-24771, CVE-2022-25883, CVE-2022-2596, CVE-2022-35948, CVE-2022-35961, CVE-2022-37620, CVE-2022-46175, CVE-2022-46337, CVE-2023-0842, CVE-2023-26158, CVE-2023-44270, CVE-2023-45133, CVE-2024-21538, CVE-2024-22195, CVE-2024-29041, CVE-2024-34064, CVE-2024-37890, CVE-2024-4067, CVE-2024-4068, CVE-2024-43796, CVE-2024-43799, CVE-2024-43800, CVE-2024-45590, CVE-2024-47764, CVE-2024-56201, CVE-2024-56326, CVE-2025-12816, CVE-2025-13466, CVE-2025-27516

## Detection guidance (public sample)

### WebSphere Liberty Java Process Spawning Windows Shell or LOLBin

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects the WebSphere Liberty JVM spawning cmd/PowerShell or download LOLBins, a typical post-exploitation pattern after RCE against a public-facing IBM application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Liberty Java Process Spawning Windows Shell or LOLBin
description: Detects the WebSphere Liberty JVM (ws-server.jar / wlp directory) spawning
  a command interpreter or download utility. Generalised post-exploitation behaviour
  for RCE in public-facing IBM application servers, not tied to a specific CVE or
  payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains:
    - ws-server.jar
    - \wlp\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection_parent and selection_child
falsepositives:
- Administrative or deployment scripts invoked from within a Liberty application that
  legitimately shell out
- Health-check or monitoring applications deployed on Liberty that call cmd.exe
level: high
id: 4d61e415-6211-59a1-80c0-c0070d830139
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1233
```

### WebSphere Liberty Java Process Spawning Shell With Download or Reverse Shell Syntax

ATT&CK: T1059.004

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects the WebSphere Liberty JVM on Linux/AIX spawning a shell that runs download, reverse-shell or decode commands, indicating likely RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Liberty Java Process Spawning Shell With Download or Reverse Shell
  Syntax
description: Detects a Java process running WebSphere Liberty (ws-server.jar or a
  /wlp/ path) spawning sh/bash with curl, wget, /dev/tcp, base64 decode or mkfifo
  in the command line. Behavioural indicator of exploitation of a public-facing IBM
  application server.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains:
    - ws-server.jar
    - /wlp/
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - base64 -d
    - mkfifo
  condition: selection_parent and selection_child
falsepositives:
- Deployed applications that legitimately call curl or wget through a shell for integration
  tasks
- Administrative automation run from a Liberty-hosted management application
level: high
id: 185f9569-5410-576f-828f-680b9c546999
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1233
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1233

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a1d936c1-d3b7-5581-ac96-7d8f4da3c3ad/multiple-vulnerabilities-in-ibm-products.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup