# IBM Patches Hundreds of Flaws Across Products

Published: 2026-10-16 · Severity: high
Canonical: https://vorant.io/reports/cfc79591-e394-5973-bc85-9f015be8df55/ibm-patches-hundreds-of-flaws-across-products

> CERT-FR advisory compiles dozens of IBM security bulletins covering RCE, privilege escalation and DoS flaws in AIX, Db2, QRadar, Sterling and WebSphere.

CERT-FR has issued a consolidated advisory referencing roughly two dozen IBM security bulletins published between October 8 and October 15, 2026, covering a very large number of vulnerabilities across multiple IBM product lines. Affected products include AIX 7.3.x, several Db2 components (Developer Extension, Intelligence Center, Db2 on Cloud Pak for Data), QRadar SIEM 7.5.x/7.6.x and its Log Management AQL Plugin, Sterling Connect:Direct for UNIX, Sterling Control Center, Sterling External Authentication Server, Sterling Partner Engagement Manager, and WebSphere Application Server (traditional 8.x/9.x and Liberty). Risk categories span remote code execution, privilege escalation, remote denial of service, SQL injection, SSRF, XSS, CSRF, security bypass, and data confidentiality/integrity impacts, indicating the bulletins bundle flaws in bundled third-party components (e.g., historical issues such as Log4Shell/CVE-2021-44228) as well as IBM-specific code.

No in-the-wild exploitation is claimed in the advisory; it is a patch-availability notice directing administrators to the referenced IBM Support pages for fixes. Given the breadth of products involved — including security-critical infrastructure such as QRadar SIEM and widely deployed application servers like WebSphere — defenders should prioritize patching internet-facing or high-value systems first, particularly WebSphere Liberty and traditional editions (upgrade to 8.5.5.31, 9.0.5.29, or the latest Liberty fix pack), QRadar SIEM (7.5.0 UP16 IF02 or 7.6.0.5), and Sterling Connect:Direct/Control Center components used in file-transfer workflows.

Because the advisory aggregates dozens of separate IBM bulletins without providing per-CVE exploitability or exploitation status, organizations should cross-reference the referenced IBM Support pages (nodes 7291777 through 7292743) to determine which CVEs apply to their specific deployed versions and apply vendor fixes according to standard patch-management SLAs, prioritizing RCE and privilege-escalation issues on exposed Db2, QRadar, Sterling and WebSphere instances.

## Mentioned in this report

- Vulnerabilities: CVE-2009-2625, CVE-2012-0881, CVE-2013-4002, CVE-2014-0107, CVE-2015-5211, CVE-2016-1000338, CVE-2016-5725 (poc), CVE-2018-1000180, CVE-2019-17359, CVE-2019-17571, CVE-2020-14338, CVE-2020-26939, CVE-2020-9488, CVE-2021-22060, CVE-2021-26291, CVE-2021-44228 (KEV), CVE-2022-22950, CVE-2022-22970, CVE-2022-34169, CVE-2022-4244, CVE-2023-20861, CVE-2023-26464, CVE-2023-33201, CVE-2024-22243, CVE-2024-29857, CVE-2024-38808, CVE-2024-53161, CVE-2025-22233, CVE-2025-31936, CVE-2025-48431, CVE-2025-62728, CVE-2025-8714, CVE-2026-0636, CVE-2026-10050, CVE-2026-11548, CVE-2026-12143, CVE-2026-13505, CVE-2026-14662, CVE-2026-15055, CVE-2026-16118

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1336

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cfc79591-e394-5973-bc85-9f015be8df55/ibm-patches-hundreds-of-flaws-across-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup