# Multiple critical flaws across IBM products

Published: 2026-06-05 · Severity: high · Sectors: technology, financial-services, government-national, healthcare
Canonical: https://vorant.io/reports/aed6ad71-bc36-5ca6-9e77-f053254bf4d9/multiple-critical-flaws-across-ibm-products

> IBM fixes multiple vulnerabilities in QRadar, Sterling Connect:Direct, and WebSphere allowing remote code execution and privilege escalation.

CERT-FR has published a security advisory covering multiple vulnerabilities across several IBM products released between late May and early June 2026. The affected products include QRadar AI Assistant, QRadar Log Source Management App, QRadar EDR, Sterling Connect:Direct for Windows and Web Services, WebSphere Application Server, WebSphere Remote Server, and WebSphere Service Registry and Repository. These vulnerabilities enable remote code execution, privilege escalation, denial of service, server-side request forgery (SSRF), cross-site scripting (XSS), SQL injection, and other security bypasses. Organizations running vulnerable versions of these products are advised to apply the available patches immediately, with some WebSphere patches not yet available (scheduled for Q3 2026). The advisory references 80+ CVEs affecting different product versions.

## Mentioned in this report

- Vulnerabilities: CVE-2021-23337 (templated), CVE-2022-24771, CVE-2022-35961, CVE-2024-28102, CVE-2025-11143, CVE-2025-12816, CVE-2025-13465, CVE-2025-15599, CVE-2025-27789, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-62718, CVE-2025-66030, CVE-2025-66031, CVE-2025-66035, CVE-2025-68161, CVE-2026-0540, CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-22036, CVE-2026-2229, CVE-2026-2332, CVE-2026-2359, CVE-2026-24486 (poc), CVE-2026-25645, CVE-2026-25793, CVE-2026-2581, CVE-2026-26007, CVE-2026-29063, CVE-2026-2950, CVE-2026-30951, CVE-2026-32286

## Detection guidance (public sample)

### WebSphere Java Process Spawning Command Shell or Script Interpreter (Windows)

ATT&CK: T1190

Detects an IBM WebSphere JVM spawning cmd, PowerShell or script hosts, which is typical post-exploitation of RCE in a public-facing WebSphere application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Command Shell or Script Interpreter (Windows)
description: Detects an IBM WebSphere JVM (java.exe under a WebSphere install path)
  spawning cmd, PowerShell, script hosts or common LOLBins. Application servers rarely
  start interactive shells, so this pattern suggests exploitation of a remote code
  execution flaw and follow-on command execution or discovery.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.discovery
- attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \WebSphere\
    ParentImage|endswith: \java.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
  condition: selection_parent and selection_child
falsepositives:
- Administrative or deployment scripts that WebSphere applications launch deliberately
  through Runtime.exec
- Custom applications hosted on WebSphere that shell out to cmd.exe for batch processing
level: high
id: eb1e839b-cf36-5e4f-b4e8-2b8e3e592070
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0698
```

### WebSphere Java Process Spawning Shell (Linux)

ATT&CK: T1059

Detects an IBM WebSphere JVM on Linux spawning a shell or download and recon utility, indicating possible RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Shell (Linux)
description: Detects a Java process running from an IBM WebSphere install path spawning
  a Unix shell or common download and recon utilities. This is a typical web-shell
  or RCE post-exploitation pattern against WebSphere Application Server.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
- attack.discovery
- attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: /WebSphere/
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /curl
    - /wget
    - /nc
    - /whoami
  condition: selection_parent and selection_child
falsepositives:
- WebSphere-hosted applications or admin tooling that deliberately invoke shell scripts
- Vendor management scripts that run through the WebSphere JVM during maintenance
level: high
id: 42bb7d9a-d213-593a-8c01-faeb6f661215
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0698
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0698

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/aed6ad71-bc36-5ca6-9e77-f053254bf4d9/multiple-critical-flaws-across-ibm-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup