Multiple vulnerabilities across IBM products require patching
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR reports dozens of vulnerabilities in IBM Db2, QRadar, WebSphere, and other products allowing RCE, privilege escalation, and denial of service.
CERT-FR has published a security advisory covering multiple vulnerabilities across IBM's product portfolio, published through August 28, 2026. The affected products span database systems (Db2), security monitoring and analytics (QRadar SIEM, QRadar AI Assistant, QRadar EDR), application middleware (WebSphere Application Server Liberty, WebSphere Extreme Scale, WebSphere Hybrid Edition), and enterprise integration tools (Sterling Connect:Direct, Tivoli products, Spectrum Control). The vulnerabilities enable a range of attack outcomes including remote code execution, privilege escalation, denial of service, server-side request forgery (SSRF), cross-site scripting (XSS), and security policy bypass. The advisory references over 300 individual CVEs but does not indicate active wild exploitation; patch availability varies by product and version. Organizations running these products should prioritize testing and deployment of vendor-supplied security updates, with attention to version-specific patches identified in IBM's security bulletins.
Mentioned in this report
Detection guidance
WebSphere Java Process Spawning Windows Shell or Script Interpreter
WebSphere/Liberty JVM spawning cmd, PowerShell, or other LOLBins - typical post-exploitation of an RCE or web shell on the app server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Windows Shell or Script Interpreter
description: Detects a Java process running IBM WebSphere or Liberty spawning a command
shell or script interpreter. This is the typical result of remote code execution
or web shell activity against the application server. Generalises on the parent/child
relation, not on specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- WebSphere
- ws-server.jar
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Administrative or deployment scripts launched by WebSphere server start/stop wrappers
- Application-specific batch jobs invoked by the hosted application
level: medium
id: c67728d9-c66c-51b2-95e9-8e9e372832c2
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1094
WebSphere Java Process Spawning Linux Shell
WebSphere/Liberty JVM spawning sh/bash or download tools on Linux, indicating possible RCE exploitation or web shell use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Java Process Spawning Linux Shell
description: Detects a Java process running IBM WebSphere or Liberty spawning a shell
or download utility on Linux. This is consistent with exploitation of a public-facing
application for RCE or with a deployed web shell.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentCommandLine|contains:
- WebSphere
- ws-server.jar
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /python
- /python3
- /perl
condition: selection_parent and selection_child
falsepositives:
- Server administration scripts started by the application server's own control scripts
- Hosted applications that legitimately shell out to helper utilities
level: medium
id: a9ae92ba-ca1b-551a-ac84-628b624a38ce
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1094
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1094
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs