IBM Patches Hundreds of Flaws Across Products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory compiles dozens of IBM security bulletins covering RCE, privilege escalation and DoS flaws in AIX, Db2, QRadar, Sterling and WebSphere.
CERT-FR has issued a consolidated advisory referencing roughly two dozen IBM security bulletins published between October 8 and October 15, 2026, covering a very large number of vulnerabilities across multiple IBM product lines. Affected products include AIX 7.3.x, several Db2 components (Developer Extension, Intelligence Center, Db2 on Cloud Pak for Data), QRadar SIEM 7.5.x/7.6.x and its Log Management AQL Plugin, Sterling Connect:Direct for UNIX, Sterling Control Center, Sterling External Authentication Server, Sterling Partner Engagement Manager, and WebSphere Application Server (traditional 8.x/9.x and Liberty). Risk categories span remote code execution, privilege escalation, remote denial of service, SQL injection, SSRF, XSS, CSRF, security bypass, and data confidentiality/integrity impacts, indicating the bulletins bundle flaws in bundled third-party components (e.g., historical issues such as Log4Shell/CVE-2021-44228) as well as IBM-specific code.
No in-the-wild exploitation is claimed in the advisory; it is a patch-availability notice directing administrators to the referenced IBM Support pages for fixes. Given the breadth of products involved — including security-critical infrastructure such as QRadar SIEM and widely deployed application servers like WebSphere — defenders should prioritize patching internet-facing or high-value systems first, particularly WebSphere Liberty and traditional editions (upgrade to 8.5.5.31, 9.0.5.29, or the latest Liberty fix pack), QRadar SIEM (7.5.0 UP16 IF02 or 7.6.0.5), and Sterling Connect:Direct/Control Center components used in file-transfer workflows.
Because the advisory aggregates dozens of separate IBM bulletins without providing per-CVE exploitability or exploitation status, organizations should cross-reference the referenced IBM Support pages (nodes 7291777 through 7292743) to determine which CVEs apply to their specific deployed versions and apply vendor fixes according to standard patch-management SLAs, prioritizing RCE and privilege-escalation issues on exposed Db2, QRadar, Sterling and WebSphere instances.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1336
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs