# Multiple vulnerabilities in IBM products

Published: 2026-09-11 · Severity: elevated · Sectors: technology, financial-services, government-national, healthcare, energy
Canonical: https://vorant.io/reports/f32665bf-7e90-552b-8f44-1153bdfdb69c/multiple-vulnerabilities-in-ibm-products

> IBM patches multiple vulnerabilities in Db2, Informix, QRadar, Sterling, and WebSphere allowing remote code execution and privilege escalation.

CERT-FR published a security advisory covering multiple vulnerabilities discovered across several IBM product lines. The affected products include Db2 (various versions including V11.5.x, V12.1, Bridge, Common Container, Developer Extension, and Cloud Pak variants), Informix Dynamic Server (versions 12.10, 14.10.x, 15.0.x), QRadar Hub, Sterling Partner Engagement Manager (Essentials and Standard editions), and WebSphere Application Server Liberty. These vulnerabilities enable multiple attack vectors including remote code execution, privilege escalation, denial of service, data integrity and confidentiality violations, security policy bypass, SSRF, XSS, and CSRF attacks. The advisory references over 200 CVEs spanning from 2010 through 2024, predominantly from third-party component dependencies rather than native product flaws. Defenders must prioritize patching based on which IBM products are deployed in their environment. IBM released security bulletins in September 2026 with specific patch versions and remediation guidance.

## Mentioned in this report

- Vulnerabilities: CVE-2024-26740, CVE-2024-26759, CVE-2024-26769, CVE-2024-26772, CVE-2024-26773, CVE-2024-26801, CVE-2024-26802, CVE-2024-26804, CVE-2024-26810, CVE-2024-26826, CVE-2024-26837, CVE-2024-26840, CVE-2024-26843, CVE-2024-26846, CVE-2024-26851, CVE-2024-26852, CVE-2024-26853, CVE-2024-26855, CVE-2024-26859, CVE-2024-26870, CVE-2024-26878, CVE-2024-26880, CVE-2024-26894, CVE-2024-26906, CVE-2024-26907, CVE-2024-26921, CVE-2024-26923, CVE-2024-26924, CVE-2024-26925, CVE-2024-26931, CVE-2024-26935, CVE-2024-26939, CVE-2024-26940, CVE-2024-26958, CVE-2024-26960, CVE-2024-26961, CVE-2024-26974, CVE-2024-26976, CVE-2024-26982

## Detection guidance (public sample)

### IBM Db2 or Informix Database Engine Spawning Command Shell

ATT&CK: T1190

Db2 (db2syscs) or Informix (oninit) engine process spawning cmd/PowerShell or LOLBins, consistent with post-exploitation after RCE in the database server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IBM Db2 or Informix Database Engine Spawning Command Shell
description: Detects the Db2 or Informix server engine process spawning a command
  interpreter or common download/execute LOLBin on Windows. This is a generic post-exploitation
  pattern after remote code execution in the database service, not tied to a specific
  CVE.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \db2syscs.exe
    - \oninit.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Db2 external stored procedures or UDFs or Informix scheduler tasks that intentionally
  call cmd.exe
- DBA maintenance scripts launched through the database engine
level: medium
id: f1ac6231-d82c-5df2-95a7-b13feff70991
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165
```

### WebSphere Liberty Java Process Spawning Shell or Download Utility

ATT&CK: T1190

Liberty server JVM spawning cmd/PowerShell/LOLBins, indicating possible web-facing RCE or webshell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WebSphere Liberty Java Process Spawning Shell or Download Utility
description: Detects a Java process launched as a WebSphere Application Server Liberty
  server spawning a command interpreter or download/execute utility on Windows. Matches
  the RCE-to-shell behaviour of exploitation of a public-facing application rather
  than any specific CVE.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \java.exe
    ParentCommandLine|contains:
    - ws-server.jar
    - ws-launch.jar
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Applications deployed on Liberty that deliberately shell out to batch scripts
- Liberty server start/stop wrapper scripts invoked from the JVM
level: medium
id: 44426291-ba6b-5846-a618-0cf58747f5ef
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165
```

### Db2 or Informix Engine Spawning Shell on Linux

ATT&CK: T1190

Linux db2sysc or oninit process spawning an interactive or scripting shell, indicating possible exploitation or privilege abuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Db2 or Informix Engine Spawning Shell on Linux
description: Detects the Db2 (db2sysc) or Informix (oninit) engine process spawning
  a shell or common scripting interpreter on Linux. This is rare in normal operation
  and suggests code execution through the database service.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /db2sysc
    - /oninit
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    - /nc
    - /curl
    - /wget
  condition: selection
falsepositives:
- Db2 fenced routines or Informix ALARMPROGRAM scripts that legitimately invoke shell
  scripts
- Database backup or archive-log scripts triggered by the engine
level: medium
id: 2da938f2-99bb-5a18-ad1b-8e27efa31aef
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1165

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f32665bf-7e90-552b-8f44-1153bdfdb69c/multiple-vulnerabilities-in-ibm-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup