Multiple vulnerabilities in IBM enterprise products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory listing multiple vulnerabilities across IBM products enabling remote code execution, privilege escalation, and denial of service.
CERT-FR has published a security advisory documenting multiple vulnerabilities affecting a broad range of IBM enterprise products including Cloud Pak System, Db2, QRadar DNS Analyzer, Sterling Connect:Direct, Sterling External Authentication Server, Sterling Order Management, Sterling Partner Engagement Manager, Sterling Secure Proxy, WebSphere Application Server, WebSphere eXtreme Scale, WebSphere Liberty Operator, and WebSphere Remote Server. The vulnerabilities enable attackers to achieve remote code execution, privilege escalation, data confidentiality and integrity compromise, denial of service, server-side request forgery, cross-site scripting, and security policy bypass. Affected organizations should apply patches available from IBM through the referenced security bulletins. The advisory does not indicate active in-the-wild exploitation but lists specific product versions requiring remediation across multiple IBM product lines.
Mentioned in this report
Detection guidance
WebSphere or Liberty Java Process Spawning Shell or Scripting Interpreter (Windows)
Detects a Java process running from an IBM WebSphere/Liberty install path spawning cmd, PowerShell or LOLBins, a typical post-exploitation pattern after RCE in an application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere or Liberty Java Process Spawning Shell or Scripting Interpreter (Windows)
description: Detects a Java process running from an IBM WebSphere or Liberty install
path spawning cmd, PowerShell or common LOLBins. Application servers rarely spawn
interactive shells; this pattern is typical after remote code execution in a public-facing
app server. Generalises on the parent/child relation, not on a specific CVE or payload.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentImage|contains:
- \WebSphere\
- \wlp\
- \Liberty\
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
filter_admin_scripts:
CommandLine|contains:
- startServer.bat
- stopServer.bat
- wsadmin.bat
condition: selection_parent and selection_child and not filter_admin_scripts
falsepositives:
- Administrative or deployment scripts launched by WebSphere through cmd.exe
- Custom applications deployed on WebSphere that intentionally shell out for batch
jobs
level: medium
id: c53b6083-3e5e-5595-a1fa-c566fff7c5d3
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0810
WebSphere or Liberty Java Process Spawning Shell With Recon or Download Commands (Linux)
Detects a Java process running from an IBM WebSphere/Liberty path spawning a shell that runs recon, download or reverse-shell style commands, indicating possible RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere or Liberty Java Process Spawning Shell With Recon or Download Commands
(Linux)
description: Detects a Java process running from an IBM WebSphere or Liberty path
spawning sh/bash with command-line content for reconnaissance, payload download
or reverse shells. Indicates possible exploitation of a remote code execution flaw
in an application server.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentImage|contains:
- /WebSphere/
- /wlp/
- /Liberty/
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- whoami
- 'id '
- curl
- wget
- /dev/tcp/
- nc
- base64
- /etc/passwd
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Application deployment or health-check scripts launched from WebSphere that call
curl or wget
- Administrators running diagnostic shell commands through wsadmin
level: medium
id: 979754ae-e412-55c0-8248-147db98d0436
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0810
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0810
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs