IBM AIX, QRadar, and Sterling face critical RCE and privilege escalation flaws

1. Executive summary

CERT-FR published advisory CERTFR-2026-AVI-1378 on 23 October 2026 covering multiple vulnerabilities across IBM AIX, VIOS, Cognos Analytics, Db2, QRadar applications, Sterling B2B Integrator, Sterling File Gateway, and WebSphere eXtreme Scale. The advisory aggregates 11 IBM security bulletins issued between 15 and 23 October 2026 and references more than 200 CVE identifiers, with reported impact spanning remote code execution, privilege escalation, remote denial of service, SSRF, XSS, and security policy bypass. Two CVEs in the set are listed in CISA KEV: CVE-2023-44487 (HTTP/2 Rapid Reset, CVSS 7.5 HIGH, EPSS 100%) and CVE-2020-11023 (jQuery XSS, CVSS 6.9 MEDIUM, EPSS 85%). EMEA financial services exposure concentrates on Sterling B2B Integrator and Sterling File Gateway, which sit on payment and file-transfer paths between institutions, and on QRadar deployments used for security monitoring. CERT-FR gives no per-CVE mapping to affected products, so clients must reconcile the CVE list against IBM bulletins before prioritising.

2. Regulatory framing

3. Technical analysis & attack chain

CERT-FR classifies the item as a multi-product vulnerability bulletin. It does not describe exploitation in the wild, does not attribute activity to any actor, and does not map individual CVEs to individual products. The attack chain below is therefore generic to the vulnerability classes CERT-FR lists, not a reconstruction of an observed intrusion.

1. An attacker reaches an exposed IBM component: AIX or VIOS NTP or tmux service, a Cognos Analytics web interface, a Db2 instance, a QRadar application endpoint, a Sterling B2B Integrator or File Gateway interface, or WebSphere eXtreme Scale.
2. The attacker sends crafted input that triggers one of the listed vulnerability classes: remote code execution, privilege escalation, remote denial of service, SSRF, XSS, or security policy bypass.
3. Where remote code execution succeeds, the attacker gains code execution in the context of the affected service.
4. Where privilege escalation succeeds, the attacker moves from a low-privileged context to a higher one on the same host.
5. Impact depends on the component: on Sterling, access to file-transfer and B2B message flows; on QRadar, access to security telemetry and log management; on AIX and VIOS, host-level control.

The two KEV-listed CVEs in the set carry the strongest evidence of real-world exploitation. CVE-2023-44487 (HTTP/2 Rapid Reset) is a protocol-level denial of service in which a client opens and immediately resets many HTTP/2 streams, exhausting server resources; it is rated CVSS 7.5 HIGH, EPSS 100%, and was added to CISA KEV on 2023-10-10. CVE-2020-11023 is a cross-site scripting flaw in jQuery versions before 3.5.0 involving HTML containing <option> elements passed to DOM manipulation methods; it is rated CVSS 6.9 MEDIUM, EPSS 85%, and was added to CISA KEV on 2025-01-23. Both are old and widely exploited; their presence in the IBM product set reflects bundled or embedded components rather than new IBM-specific flaws.

The remaining CVEs in the verified set are not in CISA KEV. CVE-2021-23337 (CVSS 7.2 HIGH, CWE-94 code injection, EPSS 21%) and CVE-2022-24785 (CVSS 7.5 HIGH, CWE-22 path traversal, EPSS 14%) are the highest-scored non-KEV entries. CVE-2021-23336 (HTTP request smuggling, CVSS 5.9 MEDIUM, EPSS 41%) has elevated EPSS relative to its score. CVE-2017-16026 (CVSS 5.9 MEDIUM, EPSS 3%), CVE-2022-42969 (CVSS 5.3 MEDIUM, EPSS 2%), CVE-2023-28155 (SSRF, CVSS 6.1 MEDIUM, EPSS 1%), and CVE-2024-47535 (CVSS 5.5 MEDIUM, EPSS 0%) are lower priority on exploitation evidence.

CERT-FR lists affected versions as: AIX 7.2 without ntp.rte.7.2; AIX 7.3 without ntp.rte.7.3; AIX 7.3.4 without tmux.rte.3.5.1.1; VIOS 4.1 without ntp.rte.7.3; Cognos Analytics 12.0.x before 12.0.4 FP3 and 12.1.x before 12.1.3 FP2; Db2 1.2.x before 1.2.1; QRadar App SDK before 2.2.8; QRadar Pulse App before 2.2.18; QRadar Use Case Manager App before 4.2.1; Security QRadar Log Management AQL Plugin 1.x.x before 1.1.11; SOAR QRadar Plugin App 5.x before 5.7.1; Sterling B2, Sterling B2B Integrator, and Sterling File Gateway 6.2.1.x before 6.2.1.3 and 6.2.2.x before 6.2.2.2; WebSphere eXtreme Scale 8.6.x.x before 8.6.2.2 with security fix PH73641 iFix.

Confidence caveat: the CVE-to-product mapping is single-sourced to IBM bulletins that Adverse Trace has not retrieved. CERT-FR lists the CVEs and the affected products separately and does not join them. Treat any per-product CVE assignment as unconfirmed until checked against the specific IBM bulletin.

4. Mitigation & containment

P1 within 24h

• Inventory every instance of Sterling B2B Integrator, Sterling File Gateway, and Sterling B2 (all 6.2.1.x and 6.2.2.x versions) and confirm patch level against 6.2.1.3 and 6.2.2.2. These sit on payment and file-transfer paths and are the highest-impact exposure in this bulletin.
• Identify any HTTP/2 endpoint in the affected IBM products and confirm mitigation for CVE-2023-44487 (HTTP/2 Rapid Reset). Where the vendor fix is not yet applied, cap concurrent HTTP/2 streams at the load balancer or reverse proxy and rate-limit stream resets.
• Identify jQuery versions below 3.5.0 in Cognos Analytics, QRadar applications, and Sterling web interfaces for CVE-2020-11023. Apply the IBM fix; where patching is deferred, restrict access to the affected web interface to trusted networks.

P2 within 72h

• Patch QRadar App SDK to 2.2.8, QRadar Pulse App to 2.2.18, QRadar Use Case Manager App to 4.2.1, Security QRadar Log Management AQL Plugin to 1.1.11, and SOAR QRadar Plugin App to 5.7.1. These are the components most likely to be internet-adjacent in a SOC.
• Patch Cognos Analytics to 12.0.4 FP3 (12.0.x) or 12.1.3 FP2 (12.1.x).
• Apply WebSphere eXtreme Scale 8.6.2.2 with security fix PH73641 iFix.
• Patch Db2 1.2.x to 1.2.1.

P3 within 7 days

• On AIX 7.2 apply ntp.rte.7.2; on AIX 7.3 and VIOS 4.1 apply ntp.rte.7.3; on AIX 7.3.4 apply tmux.rte.3.5.1.1. Restrict NTP to known internal time sources and restrict tmux socket access to authorised administrative accounts.
• Review IBM bulletins 7292743, 7287209, 7292917, 7293039, 7293040, 7293161, 7293268, 7293282, 7293283, 7293351, and 7293764 to confirm which CVE maps to which product and to catch any CVE in the IBM bulletins that CERT-FR did not list.
• Where a component cannot be patched within these windows, isolate it at the network layer and log all inbound requests to it for retrospective review.

5. Indicators of compromise

No indicators of compromise available in the source material. CERT-FR gives no hashes, domains, IP addresses, file paths, or command lines. The advisory is a vulnerability bulletin, not an incident report.

6. Detection

Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, file paths, registry keys, or other artefacts of a threat. CVE identifiers and product names are not threat artefacts. Detection should instead be built around the patch levels named in section 4 and around HTTP/2 stream-reset rate anomalies for CVE-2023-44487, using the client's own baseline.

CVE assessment

9 referenced CVEs — 2 actively exploited (CISA KEV)

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.