CERT-FR advisory CERTFR-2026-AVI-1472: IBM patches multiple flaws in AIX, Db2, QRadar, Sterling Control Center and WebSphere

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1472 groups well over a hundred CVEs across IBM products: AIX 7.2/7.3, VIOS 4.1, Db2 components, QRadar SIEM and its apps, Sterling Control Center and WebSphere Application Server (including Liberty). IBM says some allow remote arbitrary code execution, privilege escalation and remote denial of service. Others allow data integrity or confidentiality breaches, security policy bypass, SSRF, XSS and CSRF. The advisory gives no CVSS scores, no prerequisites and no CVE-to-product mapping. Fixed versions include Db2 Genius Hub and Agentics 1.1.6, QRadar SIEM 7.5.0 UP16 IF03 and 7.6.0.6, QRadar Suite 1.11.13.0, QRadar UBA 6.0.2, Sterling Control Center 6.3.1.0 iFix13, 6.4.2.0 iFix09 and 6.4.3.0 iFix01, and Db2 on Cloud Pak for Data v5.4 patch 8. AIX and VIOS need the latest security fix. WebSphere fixes are interim fixes now, with 9.0.5.30 and 26.0.0.12 due in Q4 2026 and 8.5.5.33 in Q1 2027.

Como funciona

The advisory does not describe how any individual flaw works, so no single process can be given. It only lists impact classes such as remote code execution, SSRF, XSS, CSRF and denial of service. Many entries come from bundled open-source components such as Netty, Java/Semeru runtimes and Apache projects. Whether they can be reached depends on the configuration the product exposes.

Por que é vulnerável

The articles give no root cause for the individual CVEs. They only say that many entries stem from third-party open-source components bundled in IBM products, from older flaws such as CVE-2022-24785, CVE-2023-44487 and CVE-2024-47535 to newer 2026 identifiers. The fix is to apply the updated versions or interim fixes in the IBM bulletins.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published the advisory on 6 November 2026, aggregating about twenty IBM security bulletins published between 1 and 5 November 2026. No exploitation in the wild is mentioned.

Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:24.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2023-44487. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

1. exploit-db.com · EDB-52426 ↗ · remoto · multiple · pub. 16/09/2025 não verificado

   HTTP/2 2.0 - Denial Of Service (DOS)

   This script targets the HTTP/2 Rapid Reset flaw (CVE-2023-44487) in any server that speaks HTTP/2, over the network and with no authentication. It opens a connection, sends a normal baseline of requests, then opens a batch of streams and cancels each one right away. It then measures the reset rate and server reaction to estimate risk. It is a basic exposure check, not a real attack tool: it uses one connection, a small default stream count and asks for confirmation, so it is unlikely to cause an actual outage.

   CVE-2023-44487 · autor: Madhusudhan Rajappa · explicação gerada por IA

Detalhes técnicos

Remediação