# Multiple vulnerabilities in IBM enterprise products

Published: 2026-06-26 · Severity: elevated · Sectors: technology, government-national, financial-services, energy, healthcare, telecommunications
Canonical: https://vorant.io/reports/ea79d120-d583-51d4-a969-a625becfa47c/multiple-vulnerabilities-in-ibm-enterprise-products

> CERT-FR advisory listing multiple vulnerabilities across IBM products enabling remote code execution, privilege escalation, and denial of service.

CERT-FR has published a security advisory documenting multiple vulnerabilities affecting a broad range of IBM enterprise products including Cloud Pak System, Db2, QRadar DNS Analyzer, Sterling Connect:Direct, Sterling External Authentication Server, Sterling Order Management, Sterling Partner Engagement Manager, Sterling Secure Proxy, WebSphere Application Server, WebSphere eXtreme Scale, WebSphere Liberty Operator, and WebSphere Remote Server. The vulnerabilities enable attackers to achieve remote code execution, privilege escalation, data confidentiality and integrity compromise, denial of service, server-side request forgery, cross-site scripting, and security policy bypass. Affected organizations should apply patches available from IBM through the referenced security bulletins. The advisory does not indicate active in-the-wild exploitation but lists specific product versions requiring remediation across multiple IBM product lines.

## Mentioned in this report

- Vulnerabilities: CVE-2022-24729, CVE-2023-47038, CVE-2024-29371, CVE-2024-47072, CVE-2024-47118, CVE-2025-11143, CVE-2025-11187, CVE-2025-12084, CVE-2025-12635, CVE-2025-13867, CVE-2025-14813, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469, CVE-2025-2534, CVE-2025-2668, CVE-2025-33012, CVE-2025-33134, CVE-2025-36001, CVE-2025-36006, CVE-2025-36008, CVE-2025-36009, CVE-2025-36070, CVE-2025-36098, CVE-2025-36123, CVE-2025-36131, CVE-2025-36136, CVE-2025-36184, CVE-2025-36247, CVE-2025-36353, CVE-2025-36365, CVE-2025-36366, CVE-2025-36387, CVE-2025-36407, CVE-2025-36425, CVE-2025-36427, CVE-2025-36428, CVE-2025-36442, CVE-2025-40909

## Detection guidance (public sample)

### WebSphere or Liberty Java Process Spawning Shell or Scripting Interpreter (Windows)

ATT&CK: T1059

Detects a Java process running from an IBM WebSphere/Liberty install path spawning cmd, PowerShell or LOLBins, a typical post-exploitation pattern after RCE in an application server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere or Liberty Java Process Spawning Shell or Scripting Interpreter (Windows)
description: Detects a Java process running from an IBM WebSphere or Liberty install
  path spawning cmd, PowerShell or common LOLBins. Application servers rarely spawn
  interactive shells; this pattern is typical after remote code execution in a public-facing
  app server. Generalises on the parent/child relation, not on a specific CVE or payload.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    ParentImage|contains:
    - \WebSphere\
    - \wlp\
    - \Liberty\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  filter_admin_scripts:
    CommandLine|contains:
    - startServer.bat
    - stopServer.bat
    - wsadmin.bat
  condition: selection_parent and selection_child and not filter_admin_scripts
falsepositives:
- Administrative or deployment scripts launched by WebSphere through cmd.exe
- Custom applications deployed on WebSphere that intentionally shell out for batch
  jobs
level: medium
id: c53b6083-3e5e-5595-a1fa-c566fff7c5d3
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0810
```

### WebSphere or Liberty Java Process Spawning Shell With Recon or Download Commands (Linux)

ATT&CK: T1059

Detects a Java process running from an IBM WebSphere/Liberty path spawning a shell that runs recon, download or reverse-shell style commands, indicating possible RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere or Liberty Java Process Spawning Shell With Recon or Download Commands
  (Linux)
description: Detects a Java process running from an IBM WebSphere or Liberty path
  spawning sh/bash with command-line content for reconnaissance, payload download
  or reverse shells. Indicates possible exploitation of a remote code execution flaw
  in an application server.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentImage|contains:
    - /WebSphere/
    - /wlp/
    - /Liberty/
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - 'id '
    - curl
    - wget
    - /dev/tcp/
    - nc
    - base64
    - /etc/passwd
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Application deployment or health-check scripts launched from WebSphere that call
  curl or wget
- Administrators running diagnostic shell commands through wsadmin
level: medium
id: 979754ae-e412-55c0-8248-147db98d0436
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0810
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0810

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ea79d120-d583-51d4-a969-a625becfa47c/multiple-vulnerabilities-in-ibm-enterprise-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup