1. Executive summary
CERT-FR published advisory CERTFR-2026-AVI-1378 on 23 October 2026 covering multiple vulnerabilities across IBM AIX, VIOS, Cognos Analytics, Db2, QRadar applications, Sterling B2B Integrator and File Gateway, and WebSphere eXtreme Scale. The advisory aggregates fixes from eleven IBM security bulletins issued between 15 and 23 October 2026 and references more than 200 CVE identifiers, with reported impact spanning remote code execution, privilege escalation, remote denial of service, SSRF, XSS, and data confidentiality and integrity loss. Two CVEs in the set are in CISA KEV: CVE-2023-44487 (HTTP/2 Rapid Reset, CVSS 7.5 HIGH, EPSS 100%, added 2023-10-10) and CVE-2020-11023 (jQuery XSS, CVSS 6.9 MEDIUM, EPSS 85%, added 2025-01-23). The highest-scored non-KEV entry is CVE-2022-24785 (CVSS 7.5 HIGH, path traversal). EMEA financial services exposure concentrates in QRadar (SIEM and SOAR plugins), Sterling B2B Integrator and File Gateway (payment and file transfer paths), and Cognos Analytics (regulatory and management reporting); AIX and VIOS hosts running unpatched NTP or tmux packages carry the remote DoS and privilege escalation risk. The CERT-FR advisory gives affected version ranges and bulletin references but no per-CVE product mapping, no exploitation detail, and no indicators; teams must work from the IBM bulletins to scope each CVE to a component.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | The affected estate includes ICT third-party services from a single vendor (IBM) across QRadar, Sterling, Cognos, Db2, AIX and WebSphere, with fixes delivered through eleven separate IBM bulletins and product-specific fix packs. | Third-party risk records for each IBM product must be updated with the affected version range and the vendor fix level; contractual patch and notification terms with IBM and any hosting provider are the reference point for remediation timelines. |
| DORA Art. 30 | Remediation depends on IBM fix packs and iFixes (for example ntp.rte.7.2, tmux.rte.3.5.1.1, Cognos 12.0.4 FP3, QRadar App SDK 2.2.8, WebSphere eXtreme Scale PH73641 iFix), not on customer-side configuration alone. | Confirm that current IBM support contracts entitle the organisation to the named fix packs and iFixes, and that service levels cover the patch cadence these bulletins require. |
| NIS2 Art. 21(2)(d) | The vulnerable components sit in the supply chain: QRadar apps and plugins, Sterling B2B and File Gateway, and Cognos are third-party products embedded in monitored and payment-adjacent processes. | Supply chain security measures must cover vendor patch intake for these products, including verification that deployed versions match the fixed levels named in the IBM bulletins. |
3. Technical analysis & attack chain
This is a vendor patch roundup, not a single exploited vulnerability. CERT-FR lists affected products and version ranges and defers remediation to eleven IBM bulletins; it does not map individual CVEs to individual products, and it gives no exploitation narrative. The attack chain below is therefore stated at the level the sources support: what an attacker gains per reported impact class, and which components are exposed.
Prioritised triage, ordered by CISA KEV status then EPSS from NVD, EPSS and CISA KEV:
| CVE | Component (as scoped by CERT-FR) | CVSS | KEV / EPSS | Why it matters |
|---|---|---|---|---|
| CVE-2023-44487 | HTTP/2-capable front ends in the affected stack (QRadar, Cognos, WebSphere eXtreme Scale); CERT-FR does not name the exact component | 7.5 HIGH | KEV (added 2023-10-10) / 100% | HTTP/2 Rapid Reset. Weaponised at scale since 2023; any internet-facing HTTP/2 endpoint in scope is a DoS candidate. |
| CVE-2020-11023 | Web UI components (Cognos Analytics, QRadar apps); jQuery-dependent interfaces | 6.9 MEDIUM | KEV (added 2025-01-23) / 85% | jQuery XSS via HTML passed to DOM manipulation methods. Session theft against analyst and reporting consoles. |
| CVE-2021-23337 | Node.js-dependent components (QRadar App SDK and apps) | 7.2 HIGH | Not in KEV / 21% | Code injection via the lodash template function. Relevant where QRadar apps run third-party JavaScript. |
| CVE-2022-24785 | JavaScript-dependent components (QRadar apps, Cognos) | 7.5 HIGH | Not in KEV / 14% | Path traversal in moment.js locale handling. |
| CVE-2021-23336 | Python-dependent components (QRadar apps, SOAR plugins) | 5.9 MEDIUM | Not in KEV / 41% | HTTP request smuggling via Python's urllib parse_qsl. |
| CVE-2017-16026 | Node.js-dependent components | 5.9 MEDIUM | Not in KEV / 3% | Improper input validation in the request package; CWE-201 information exposure. |
| CVE-2022-42969 | Python-dependent components | 5.3 MEDIUM | Not in KEV / 2% | ReDoS in py library. |
| CVE-2023-28155 | Node.js-dependent components | 6.1 MEDIUM | Not in KEV / 1% | SSRF in the request package. |
| CVE-2024-47535 | Java/Netty-dependent components | 5.5 MEDIUM | Not in KEV / 0% | Uncontrolled resource consumption in Netty. |
The remaining CVEs referenced by CERT-FR (more than 190 identifiers, including CVE-2025-12635, CVE-2025-13465, CVE-2026-0636 through CVE-2026-0848, and the CVE-2026-4xxxx and CVE-2026-6xxxx series) have no severity, EPSS or KEV data in the verified set. Treat them as unscored until the IBM bulletins are read; do not assume they are low.
Attack chain, at the level the sources confirm:
- An attacker reaches an exposed interface of an affected product. CERT-FR names remote code execution, remote denial of service, SSRF, XSS and privilege escalation as the impact classes but does not identify the entry point for any specific CVE.
- For CVE-2023-44487, the attacker opens and resets HTTP/2 streams rapidly, consuming server resources until the service degrades or fails. This is the only CVE in the set with a publicly documented mechanism that maps cleanly to a named component class.
- For CVE-2020-11023, the attacker delivers HTML through an input that jQuery passes to a DOM manipulation method, executing script in the context of an authenticated console session.
- For CVE-2021-23337, CVE-2022-24785 and CVE-2021-23336, the attacker supplies crafted input to the vulnerable library function (lodash template, moment.js locale, Python parse_qsl) through whatever application surface exposes it. CERT-FR does not state which QRadar or Cognos endpoint does so.
- Post-exploitation, persistence, command-and-control, lateral movement and exfiltration steps are not described in any source provided. No actor is named and no campaign is attributed.
The two KEV entries are the only CVEs in the set with confirmed in-the-wild exploitation. CVE-2023-44487 exploitation is generic to HTTP/2 servers and does not indicate targeting of IBM products specifically. CVE-2020-11023 exploitation is generic to jQuery and likewise does not indicate targeting of Cognos or QRadar. Neither KEV listing should be read as evidence that IBM estates are being actively attacked.
Single-source caveat: the entire product-to-version mapping and the impact list rest on CERT-FR's advisory alone. The IBM bulletins it cites were not retrieved for this note. Where CERT-FR gives a version range without a CVE (for example AIX 7.2 without ntp.rte.7.2, AIX 7.3.4 without tmux.rte.3.5.1.1, VIOS 4.1 without ntp.rte.7.3), the specific CVE behind that fix is not stated and must be read from the corresponding IBM bulletin.
4. Mitigation & containment
P1 within 24 hours
- Inventory every instance of the products named by CERT-FR and record the exact version: AIX 7.2 and 7.3, VIOS 4.1, Cognos Analytics 12.0.x and 12.1.x, Db2 1.2.x, QRadar App SDK, QRadar Pulse App, QRadar Use Case Manager App, Security QRadar Log Management AQL Plugin, SOAR QRadar Plugin App, Sterling B2 and B2B Integrator 6.2.1.x and 6.2.2.x, Sterling File Gateway 6.2.1.x and 6.2.2.x, WebSphere eXtreme Scale 8.6.x.x.
- For any internet-facing HTTP/2 endpoint in that inventory, apply the CVE-2023-44487 mitigation: rate-limit HTTP/2 request streams at the load balancer or reverse proxy, or disable HTTP/2 where the business does not require it. This is the only KEV entry in the set with a network-level control that does not wait on a vendor fix.
- Restrict network access to QRadar consoles, Cognos Analytics portals and Sterling B2B and File Gateway management interfaces to known administrative networks. These are the components where XSS (CVE-2020-11023) and the library-level injection flaws would be reached from a browser session.
- Confirm whether the deployed QRadar apps and plugins are at or above the fixed levels named by CERT-FR: App SDK 2.2.8, Pulse App 2.2.18, Use Case Manager App 4.2.1, AQL Plugin 1.1.11, SOAR QRadar Plugin 5.7.1.
P2 within 72 hours
- Apply the IBM fix packs for the highest-scored non-KEV entries: CVE-2021-23337 (CVSS 7.2) and CVE-2022-24785 (CVSS 7.5). CERT-FR does not state which product each maps to; read IBM bulletins 7292743, 7287209, 7292917, 7293039, 7293040, 7293161, 7293268, 7293282, 7293283, 7293351 and 7293764 to establish the mapping before scheduling.
- On AIX 7.2 and 7.3, install ntp.rte.7.2 or ntp.rte.7.3 respectively. On AIX 7.3.4, install tmux.rte.3.5.1.1. On VIOS 4.1, install ntp.rte.7.3.
- Upgrade Cognos Analytics to 12.0.4 FP3 (12.0.x branch) or 12.1.3 FP2 (12.1.x branch).
- Upgrade Sterling B2, B2B Integrator and File Gateway to 6.2.1.3 (6.2.1.x branch) or 6.2.2.2 (6.2.2.x branch). These products carry payment and file transfer traffic; schedule the change with the business owner rather than in a standard maintenance window.
- Apply the WebSphere eXtreme Scale 8.6.2.2 security fix PH73641 iFix.
P3 within 7 days
- Upgrade Db2 to 1.2.1 or later.
- Complete the QRadar app and plugin upgrades not finished at P1.
- For the more than 190 CVEs CERT-FR references without severity data, read each IBM bulletin and assign internal severity before closing the change. Do not close on the basis that CERT-FR did not score them.
Containment where patching cannot meet the timeline: place affected QRadar, Cognos and Sterling management interfaces behind an authenticated reverse proxy with request-size and rate limits; block outbound requests from QRadar apps and Cognos servers to internal address ranges to blunt SSRF (CVE-2023-28155) and path traversal (CVE-2022-24785) reach; and enable verbose logging on the affected hosts so the detection rules in §6 have data to match.
5. Indicators of compromise
No indicators of compromise available in the source material. CERT-FR gives affected version ranges and bulletin references only; it publishes no hashes, domains, IP addresses, file paths or command lines. The IBM bulletins were not retrieved for this note.
Behavioural indicators, derived from the CVE mechanisms in the verified set and the CERT-FR impact list. These are generic to the vulnerability classes, not to a specific campaign, and none is attributed to an actor:
| Behaviour | Where to observe | Confidence |
|---|---|---|
| High rate of HTTP/2 stream resets (RST_STREAM) from a single client or small client set | Load balancer, reverse proxy and web server logs for QRadar, Cognos and WebSphere eXtreme Scale front ends | Medium (mechanism confirmed for CVE-2023-44487; applicability to specific IBM components not stated by CERT-FR) |
| Script execution in an authenticated Cognos or QRadar console session from a crafted HTML input | Browser-side CSP reports, web application firewall logs, Cognos and QRadar audit logs | Medium (CVE-2020-11023 is a confirmed KEV XSS; the affected IBM surface is not named) |
| Outbound requests from QRadar app or Cognos server processes to internal RFC1918 addresses or metadata endpoints | Egress firewall, proxy logs, host network telemetry | Low (SSRF is listed by CERT-FR as an impact class; no CVE-to-component mapping given) |
| Unexpected file reads outside the application directory by Cognos or QRadar app processes | Host EDR file-access telemetry | Low (path traversal CVE-2022-24785 is in the set; component mapping not stated) |
| Service degradation or crash on AIX or VIOS hosts running unpatched NTP or tmux | AIX errpt, VIOS logs, service availability monitoring | Low (CERT-FR lists remote DoS as an impact class for these fix levels; no CVE named) |
6. Detection
The sources contain no malware artefacts, no command lines, no file paths, no registry keys and no hard-coded values from which a YARA rule could be built. A YARA rule matching CVE identifiers or product names would detect reporting about the vulnerabilities, not exploitation of them, so none is emitted.
A Sigma rule is possible for the one CVE with a documented, observable network behaviour (CVE-2023-44487). It matches on HTTP/2 stream-reset volume in web server or proxy logs and is generic to the technique, not to IBM products.
title: HTTP/2 Rapid Reset stream reset burst (CVE-2023-44487)
id: 8f3c2a71-4b6e-4d19-9c2a-7e5f1b0d3a84
status: experimental
description: Detects a high volume of HTTP/2 RST_STREAM events from a single source within a short window, consistent with CVE-2023-44487 Rapid Reset. Generic to the technique; not specific to IBM products.
author: Adverse Trace
date: 2026-10-23
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1378/
- https://www.cve.org/CVERecord?id=CVE-2023-44487
logsource:
category: webserver
detection:
selection:
http2.stream_reset: true
timeframe: 1m
condition: selection | count() by src_ip > 100
fields:
- src_ip
- http2.stream_reset
falsepositives:
- Legitimate clients with aggressive connection recycling
- Load balancer health checks that open and reset streams
level: medium
The rule requires the log source to record HTTP/2 stream reset events with source IP; many web servers do not log this by default, so confirm the field is populated before relying on the rule. Tune the threshold against baseline traffic.
CVE assessment
9 referenced CVEs — 2 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2023-44487 | 7.5 High | ⚠ KEV 2023-10-10 | 100% | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many stream… |
| CVE-2020-11023 | 6.9 Medium | ⚠ KEV 2025-01-23 | 85% | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing |
| CVE-2022-24785 | 7.5 High | — | 14% | Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerabil… |
| CVE-2021-23337 | 7.2 High | — | 21% | Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. |
| CVE-2023-28155 | 6.1 Medium | — | 1% | The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does… |
| CVE-2017-16026 | 5.9 Medium | — | 3% | Request is an http client. If a request is made using multipart, and the body type is a number, then the specified… |
| CVE-2021-23336 | 5.9 Medium | — | 41% | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and… |
| CVE-2024-47535 | 5.5 Medium | — | 0% | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance prot… |
| CVE-2022-42969 | 5.3 Medium | — | 2% | The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) atta… |
Could not resolve: CVE-2016-1000240.
7. Sources
- ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits IBM" (CERTFR-2026-AVI-1378), 23 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1378/
- IBM Security Bulletin 7292743, 15 October 2026. https://www.ibm.com/support/pages/node/7292743
- IBM Security Bulletin 7287209, 16 October 2026. https://www.ibm.com/support/pages/node/7287209
- IBM Security Bulletin 7292917, 16 October 2026. https://www.ibm.com/support/pages/node/7292917
- IBM Security Bulletin 7293039, 19 October 2026. https://www.ibm.com/support/pages/node/7293039
- IBM Security Bulletin 7293040, 19 October 2026. https://www.ibm.com/support/pages/node/7293040
- IBM Security Bulletin 7293161, 20 October 2026. https://www.ibm.com/support/pages/node/7293161
- IBM Security Bulletin 7293268, 21 October 2026. https://www.ibm.com/support/pages/node/7293268
- IBM Security Bulletin 7293282, 21 October 2026. https://www.ibm.com/support/pages/node/7293282
- IBM Security Bulletin 7293283, 21 October 2026. https://www.ibm.com/support/pages/node/7293283
- IBM Security Bulletin 7293351, 21 October 2026. https://www.ibm.com/support/pages/node/7293351
- IBM Security Bulletin 7293764, 23 October 2026. https://www.ibm.com/support/pages/node/7293764
- ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits IBM" (CERTFR-2026-AVI-1336), 16 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1336/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits IBM" (CERTFR-2026-AVI-1094), 28 August 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1094/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits IBM" (CERTFR-2026-AVI-1067), 21 August 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1067/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits IBM" (CERTFR-2026-AVI-0933), 24 July 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0933/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits IBM" (CERTFR-2026-AVI-0901), 17 July 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0901/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits IBM" (CERTFR-2026-AVI-0810), 26 June 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0810/
- NVD, CVE-2023-44487. https://nvd.nist.gov/vuln/detail/CVE-2023-44487
- NVD, CVE-2020-11023. https://nvd.nist.gov/vuln/detail/CVE-2020-11023
- CISA Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
8. Adverse Trace position
Adverse Trace assesses this as a high-volume vendor patch roundup with two confirmed-exploited CVEs in the set and no evidence of targeted exploitation of IBM products. The severity that matters is CVE-2023-44487 (CVSS 7.5 HIGH, CISA KEV, EPSS 100%) for any internet-facing HTTP/2 endpoint in the affected estate, and CVE-2020-11023 (CVSS 6.9 MEDIUM, CISA KEV, EPSS 85%) for Cognos and QRadar consoles reachable from user browsers. The remaining scored CVEs are MEDIUM to HIGH with EPSS between 0% and 41%; the more than 190 unscored CVEs CERT-FR references are the larger unknown and should not be treated as low until the IBM bulletins are read. Client impact concentrates in QRadar (detection coverage loss if the SIEM is degraded), Sterling B2B Integrator and File Gateway (payment and file transfer disruption), and Cognos (regulatory reporting availability). The product-to-CVE mapping and the impact list rest on CERT-FR alone; the IBM bulletins were not retrieved for this note, so the mapping is single-sourced and should be verified against each bulletin before change scheduling. No actor is named in any source and no attribution is made. Adverse Trace will retrieve the eleven IBM bulletins to build the per-CVE product mapping, monitor CISA KEV and EPSS for movement on the unscored identifiers, and issue an update if any of the referenced CVEs is added to KEV or shows exploitation against IBM products in client telemetry.
Published via PulseTrace — Adverse Trace threat intelligence.