Multiple critical flaws across IBM products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
IBM fixes multiple vulnerabilities in QRadar, Sterling Connect:Direct, and WebSphere allowing remote code execution and privilege escalation.
CERT-FR has published a security advisory covering multiple vulnerabilities across several IBM products released between late May and early June 2026. The affected products include QRadar AI Assistant, QRadar Log Source Management App, QRadar EDR, Sterling Connect:Direct for Windows and Web Services, WebSphere Application Server, WebSphere Remote Server, and WebSphere Service Registry and Repository. These vulnerabilities enable remote code execution, privilege escalation, denial of service, server-side request forgery (SSRF), cross-site scripting (XSS), SQL injection, and other security bypasses. Organizations running vulnerable versions of these products are advised to apply the available patches immediately, with some WebSphere patches not yet available (scheduled for Q3 2026). The advisory references 80+ CVEs affecting different product versions.
Mentioned in this report
Detection guidance
WebSphere Java Process Spawning Command Shell or Script Interpreter (Windows)
Detects an IBM WebSphere JVM spawning cmd, PowerShell or script hosts, which is typical post-exploitation of RCE in a public-facing WebSphere application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Command Shell or Script Interpreter (Windows)
description: Detects an IBM WebSphere JVM (java.exe under a WebSphere install path)
spawning cmd, PowerShell, script hosts or common LOLBins. Application servers rarely
start interactive shells, so this pattern suggests exploitation of a remote code
execution flaw and follow-on command execution or discovery.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \WebSphere\
ParentImage|endswith: \java.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
condition: selection_parent and selection_child
falsepositives:
- Administrative or deployment scripts that WebSphere applications launch deliberately
through Runtime.exec
- Custom applications hosted on WebSphere that shell out to cmd.exe for batch processing
level: high
id: eb1e839b-cf36-5e4f-b4e8-2b8e3e592070
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0698
WebSphere Java Process Spawning Shell (Linux)
Detects an IBM WebSphere JVM on Linux spawning a shell or download and recon utility, indicating possible RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Shell (Linux)
description: Detects a Java process running from an IBM WebSphere install path spawning
a Unix shell or common download and recon utilities. This is a typical web-shell
or RCE post-exploitation pattern against WebSphere Application Server.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains: /WebSphere/
ParentImage|endswith: /java
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /curl
- /wget
- /nc
- /whoami
condition: selection_parent and selection_child
falsepositives:
- WebSphere-hosted applications or admin tooling that deliberately invoke shell scripts
- Vendor management scripts that run through the WebSphere JVM during maintenance
level: high
id: 42bb7d9a-d213-593a-8c01-faeb6f661215
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0698
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0698
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs