# Multiple vulnerabilities across IBM products require patching

Published: 2026-08-28 · Severity: elevated · Sectors: government-national, defense, financial-services, energy, healthcare, technology, telecommunications
Canonical: https://vorant.io/reports/ee93aa1a-04fb-530e-998a-eea4141e716c/multiple-vulnerabilities-across-ibm-products-require-patching

> CERT-FR reports dozens of vulnerabilities in IBM Db2, QRadar, WebSphere, and other products allowing RCE, privilege escalation, and denial of service.

CERT-FR has published a security advisory covering multiple vulnerabilities across IBM's product portfolio, published through August 28, 2026. The affected products span database systems (Db2), security monitoring and analytics (QRadar SIEM, QRadar AI Assistant, QRadar EDR), application middleware (WebSphere Application Server Liberty, WebSphere Extreme Scale, WebSphere Hybrid Edition), and enterprise integration tools (Sterling Connect:Direct, Tivoli products, Spectrum Control). The vulnerabilities enable a range of attack outcomes including remote code execution, privilege escalation, denial of service, server-side request forgery (SSRF), cross-site scripting (XSS), and security policy bypass. The advisory references over 300 individual CVEs but does not indicate active wild exploitation; patch availability varies by product and version. Organizations running these products should prioritize testing and deployment of vendor-supplied security updates, with attention to version-specific patches identified in IBM's security bulletins.

## Mentioned in this report

- Vulnerabilities: CVE-2018-16487, CVE-2021-23336, CVE-2024-24762, CVE-2025-10263, CVE-2025-13151, CVE-2025-14505, CVE-2025-14914, CVE-2025-14920, CVE-2025-15599, CVE-2025-40026, CVE-2025-47273, CVE-2025-47279, CVE-2025-47914, CVE-2025-48913, CVE-2025-54410, CVE-2025-58181, CVE-2025-5889, CVE-2025-6170, CVE-2025-62718, CVE-2025-64718, CVE-2025-66168, CVE-2025-69873, CVE-2025-71066, CVE-2025-71089, CVE-2026-0540, CVE-2026-10050, CVE-2026-10051, CVE-2026-10535, CVE-2026-10842, CVE-2026-10846, CVE-2026-10879, CVE-2026-11525, CVE-2026-11541, CVE-2026-11806, CVE-2026-11897, CVE-2026-12143, CVE-2026-12151, CVE-2026-12243, CVE-2026-12413, CVE-2026-12505

## Detection guidance (public sample)

### WebSphere Java Process Spawning Windows Shell or Script Interpreter

ATT&CK: T1190

WebSphere/Liberty JVM spawning cmd, PowerShell, or other LOLBins - typical post-exploitation of an RCE or web shell on the app server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Windows Shell or Script Interpreter
description: Detects a Java process running IBM WebSphere or Liberty spawning a command
  shell or script interpreter. This is the typical result of remote code execution
  or web shell activity against the application server. Generalises on the parent/child
  relation, not on specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains:
    - WebSphere
    - ws-server.jar
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Administrative or deployment scripts launched by WebSphere server start/stop wrappers
- Application-specific batch jobs invoked by the hosted application
level: medium
id: c67728d9-c66c-51b2-95e9-8e9e372832c2
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1094
```

### WebSphere Java Process Spawning Linux Shell

ATT&CK: T1190

WebSphere/Liberty JVM spawning sh/bash or download tools on Linux, indicating possible RCE exploitation or web shell use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Java Process Spawning Linux Shell
description: Detects a Java process running IBM WebSphere or Liberty spawning a shell
  or download utility on Linux. This is consistent with exploitation of a public-facing
  application for RCE or with a deployed web shell.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains:
    - WebSphere
    - ws-server.jar
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
    - /nc
    - /python
    - /python3
    - /perl
  condition: selection_parent and selection_child
falsepositives:
- Server administration scripts started by the application server's own control scripts
- Hosted applications that legitimately shell out to helper utilities
level: medium
id: a9ae92ba-ca1b-551a-ac84-628b624a38ce
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1094
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1094

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ee93aa1a-04fb-530e-998a-eea4141e716c/multiple-vulnerabilities-across-ibm-products-require-patching.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup