Multiple vulnerabilities in IBM products (July 10, 2026)

unknownCVE-2026-26007 CVE-2026-50645 CVE-2026-11383 CVE-2026-39892 CVE-2026-9171 CVE-2026-11541

Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote denial of service, data confidentiality breaches, and server-side request forgery (SSRF).

CSIRTS triage

vendor: IBM Denial of service Information disclosure Server-side request forgery

What: Multiple vulnerabilities allow an attacker to cause remote denial of service, data confidentiality breaches, and server-side request forgery (SSRF).
Who is affected: Deployments of affected IBM products are affected.
Urgency: Remediation is urgent due to the potential for serious security issues including denial of service and data breaches.
Action: Update to the latest versions of affected IBM products.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-07-10
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0865/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-260070.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-506450.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-113830.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-398920.65% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-91710.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-115410.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-117070.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-115460.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-340730.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-115940.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-26007	coverage & exploitation status	NVD · CVE.org
CVE-2026-50645	coverage & exploitation status	NVD · CVE.org
CVE-2026-11383	coverage & exploitation status	NVD · CVE.org
CVE-2026-39892	coverage & exploitation status	NVD · CVE.org
CVE-2026-9171	coverage & exploitation status	NVD · CVE.org
CVE-2026-11541	coverage & exploitation status	NVD · CVE.org
CVE-2026-11707	coverage & exploitation status	NVD · CVE.org
CVE-2026-11546	coverage & exploitation status	NVD · CVE.org
CVE-2026-34073	coverage & exploitation status	NVD · CVE.org
CVE-2026-11594	coverage & exploitation status	NVD · CVE.org
CVE-2025-66471	coverage & exploitation status	NVD · CVE.org
CVE-2026-21441	coverage & exploitation status	NVD · CVE.org
CVE-2024-29371	coverage & exploitation status	NVD · CVE.org
CVE-2026-11708	coverage & exploitation status	NVD · CVE.org
CVE-2025-69277	coverage & exploitation status	NVD · CVE.org
CVE-2026-11595	coverage & exploitation status	NVD · CVE.org
CVE-2026-11714	coverage & exploitation status	NVD · CVE.org
CVE-2026-9322	coverage & exploitation status	NVD · CVE.org
CVE-2026-9563	coverage & exploitation status	NVD · CVE.org
CVE-2026-11712	coverage & exploitation status	NVD · CVE.org
CVE-2026-11806	coverage & exploitation status	NVD · CVE.org
CVE-2025-66418	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] IBM WebSphere Application Server: Multiple vulnerabilitiescert-bund
high[UPDATE] [high] IBM WebSphere Application Server and Application Server Liberty: Multiple vulnerabilitiescert-bund
medium[NEW] [medium] IBM WebSphere Application Server: Multiple vulnerabilities enable Denial of Servicecert-bund
medium[UPDATE] [medium] Red Hat Hardened Images RPMs: Multiple vulnerabilitiescert-bund
unknownexploitedMultiple vulnerabilities in IBM products (August 21, 2026)cert-fr-avis
high[NEW] [high] Splunk SOAR: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
unknownNCSC-2026-0307 [1.00] [M/H] Vulnerabilities resolved in Oracle Database Productsncsc-nl
medium[UPDATE] [medium] Apache CXF: Multiple vulnerabilitiescert-bund
unknownexploitedMultiple vulnerabilities in IBM products (August 14, 2026)cert-fr-avis
high[UPDATE] [high] Red Hat Enterprise Linux (urllib3): Multiple vulnerabilities allow denial of servicecert-bund
medium[NEW] [medium] IBM WebSphere Application Server Liberty: Vulnerability allows denial of servicecert-bund