Multiple vulnerabilities in IBM products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
IBM patches multiple vulnerabilities in Db2, Informix, QRadar, Sterling, and WebSphere allowing remote code execution and privilege escalation.
CERT-FR published a security advisory covering multiple vulnerabilities discovered across several IBM product lines. The affected products include Db2 (various versions including V11.5.x, V12.1, Bridge, Common Container, Developer Extension, and Cloud Pak variants), Informix Dynamic Server (versions 12.10, 14.10.x, 15.0.x), QRadar Hub, Sterling Partner Engagement Manager (Essentials and Standard editions), and WebSphere Application Server Liberty. These vulnerabilities enable multiple attack vectors including remote code execution, privilege escalation, denial of service, data integrity and confidentiality violations, security policy bypass, SSRF, XSS, and CSRF attacks. The advisory references over 200 CVEs spanning from 2010 through 2024, predominantly from third-party component dependencies rather than native product flaws. Defenders must prioritize patching based on which IBM products are deployed in their environment. IBM released security bulletins in September 2026 with specific patch versions and remediation guidance.
Mentioned in this report
Detection guidance
IBM Db2 or Informix Database Engine Spawning Command Shell
Db2 (db2syscs) or Informix (oninit) engine process spawning cmd/PowerShell or LOLBins, consistent with post-exploitation after RCE in the database server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IBM Db2 or Informix Database Engine Spawning Command Shell
description: Detects the Db2 or Informix server engine process spawning a command
interpreter or common download/execute LOLBin on Windows. This is a generic post-exploitation
pattern after remote code execution in the database service, not tied to a specific
CVE.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \db2syscs.exe
- \oninit.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Db2 external stored procedures or UDFs or Informix scheduler tasks that intentionally
call cmd.exe
- DBA maintenance scripts launched through the database engine
level: medium
id: f1ac6231-d82c-5df2-95a7-b13feff70991
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165
WebSphere Liberty Java Process Spawning Shell or Download Utility
Liberty server JVM spawning cmd/PowerShell/LOLBins, indicating possible web-facing RCE or webshell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebSphere Liberty Java Process Spawning Shell or Download Utility
description: Detects a Java process launched as a WebSphere Application Server Liberty
server spawning a command interpreter or download/execute utility on Windows. Matches
the RCE-to-shell behaviour of exploitation of a public-facing application rather
than any specific CVE.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- ws-server.jar
- ws-launch.jar
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
condition: selection_parent and selection_child
falsepositives:
- Applications deployed on Liberty that deliberately shell out to batch scripts
- Liberty server start/stop wrapper scripts invoked from the JVM
level: medium
id: 44426291-ba6b-5846-a618-0cf58747f5ef
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165
Db2 or Informix Engine Spawning Shell on Linux
Linux db2sysc or oninit process spawning an interactive or scripting shell, indicating possible exploitation or privilege abuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Db2 or Informix Engine Spawning Shell on Linux
description: Detects the Db2 (db2sysc) or Informix (oninit) engine process spawning
a shell or common scripting interpreter on Linux. This is rare in normal operation
and suggests code execution through the database service.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /db2sysc
- /oninit
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /nc
- /curl
- /wget
condition: selection
falsepositives:
- Db2 fenced routines or Informix ALARMPROGRAM scripts that legitimately invoke shell
scripts
- Database backup or archive-log scripts triggered by the engine
level: medium
id: 2da938f2-99bb-5a18-ad1b-8e27efa31aef
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs