# IBM DB2, QRadar, Sterling Connect:Direct vulnerabilities

Published: 2026-09-04 · Severity: elevated · Sectors: financial-services, government-national, healthcare, technology
Canonical: https://vorant.io/reports/f7d05d8a-91b2-534c-b52d-9d200659ae42/ibm-db2-qradar-sterling-connect-direct-vulnerabilities

> Multiple vulnerabilities in IBM database, SIEM and file-transfer products allow remote code execution and denial of service.

CERT-FR has published a security advisory covering multiple vulnerabilities across four IBM product lines. DB2 Query Management Facility for z/OS (versions 12.2.0.5, 13.1.x, 13.1.1, 13.1.2, 13.1.3), QRadar SIEM (7.5.x before 7.5.0 UP16 and 7.6.x before 7.6.0 FP3), and Sterling Connect:Direct for Microsoft Windows (6.3.x before 6.3.0.6_iFix076 and 6.4.x before 6.4.0.5_iFix012) are all affected.

The vulnerabilities enable attackers to achieve remote code execution, remote denial of service, data integrity compromise, and security policy bypass. Defenders running these products in their infrastructure—particularly those using QRadar for security monitoring or DB2 for mainframe database operations—should treat patching as urgent. The advisory references 40 CVE identifiers and directs administrators to IBM's security bulletins for specific patches corresponding to each affected product version.

## Mentioned in this report

- Vulnerabilities: CVE-2025-61984, CVE-2025-61985, CVE-2025-66614, CVE-2025-68161, CVE-2025-9714, CVE-2026-16243, CVE-2026-16439, CVE-2026-16441, CVE-2026-22007, CVE-2026-22008, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-24733, CVE-2026-24734, CVE-2026-34268, CVE-2026-34282, CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-34481, CVE-2026-41254, CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47057, CVE-2026-47058, CVE-2026-47059, CVE-2026-47063, CVE-2026-49844, CVE-2026-55223, CVE-2026-5588, CVE-2026-60147, CVE-2026-6918, CVE-2026-8400

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1121

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f7d05d8a-91b2-534c-b52d-9d200659ae42/ibm-db2-qradar-sterling-connect-direct-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup