Multiple critical vulnerabilities discovered in various IBM products including Big SQL, Cognos Analytics, and QRadar
Numerous security vulnerabilities have been identified across multiple IBM products including IBM Big SQL, Cognos Analytics, IBM Common Licensing, QRadar suite, SPSS Collaboration and Deployment Services, WebSphere Application Server, and WebSphere Service Registry and Repository. These flaws include remote code execution, denial of service, data confidentiality breaches, server-side request forgery (SSRF), cross-site scripting (XSS), and cross-site request forgery (CSRF), among others. These vulnerabilities affect multiple versions and require timely patching to mitigate the risks of data integrity compromise, unauthorized access, and system disruptions. IBM has released multiple security bulletins between November 6 and 13, 2026, detailing fixes for these issues. The wide range of CVEs associated with these vulnerabilities highlights the critical need for comprehensive security updates across affected IBM products.
Entenda a falha
A vulnerabilidade
This is a roundup of IBM security bulletins published between November 6 and 13, 2026, covering a very large set of CVEs (several from 2020-2024, most from 2026) across many products. The CERT-FR advisory lists the impact classes as remote arbitrary code execution, remote denial of service, loss of data confidentiality and integrity, security policy bypass, SSRF, XSS and CSRF. It does not say which CVE maps to which impact, nor give per-CVE severity, so the most severe ones cannot be singled out. Affected: Big SQL (Cloud Pak for Data and Software Hub 5.x) without the latest fix; Cognos Analytics 11.2.x, 12.0.x and 12.1.x before 12.1.3 FP4 or 12.2.0; Common Licensing 9.0.0.2, 9.1.0 and ART 9.0/9.0.0.1 without the latest fix. QRadar apps fixed in: Analyst Workflow 3.1.2, Deployment Intelligence 3.0.21, Log Source Management 7.0.19, Threat Intelligence 2.6.1, Use Case Manager 4.2.2, EDR 3.12.27. Also affected: SPSS Collaboration and Deployment Services 8.x/9.0.0.0, WebSphere Application Server 7.x (fix SJ11934) and WebSphere Service Registry and Repository before 8.5 (APAR IJ60609).
Como foi descoberta
The articles do not say how the flaws were found or who reported them. CERT-FR published advisory CERTFR-2026-AVI-1539 on November 13, 2026, summarizing IBM security bulletins issued from November 6 to 13 (for example 7295841 on Nov 6 and 7296656 on Nov 13). It states that the vulnerabilities were discovered in IBM products and points to the vendor bulletins for the fixes. For some items the impact is listed as unspecified by the vendor.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:28.
Linha do tempo
-
Multiple critical vulnerabilities discovered in various IBM products including Big SQL, Cognos Analytics, and QRadar
ler a análise desta fonte ocultar
Numerous security vulnerabilities have been identified across multiple IBM products including IBM Big SQL, Cognos Analytics, IBM Common Licensing, QRadar suite, SPSS Collaboration and Deployment Services, WebSphere Application Server, and WebSphere Service Registry and Repository. These flaws include remote code execution, denial of service, data confidentiality breaches, server-side request forgery (SSRF), cross-site scripting (XSS), and cross-site request forgery (CSRF), among others. These vulnerabilities affect multiple versions and require timely patching to mitigate the risks of data integrity compromise, unauthorized access, and system disruptions. IBM has released multiple security bulletins between November 6 and 13, 2026, detailing fixes for these issues. The wide range of CVEs associated with these vulnerabilities highlights the critical need for comprehensive security updates across affected IBM products.