Multiple vulnerabilities in IBM products (July 3, 2026)
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and a remote denial of service.
CSIRTS triage
- What
- Multiple vulnerabilities can allow remote arbitrary code execution, privilege escalation, and remote denial of service.
- Who is affected
- Users of IBM products.
- Urgency
- Remediation urgency is unclear but should be prioritized due to potential impacts.
- Action
- Monitor for updates from IBM regarding these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch null
Get an email when a new null advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0834/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-506450.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-113830.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-420410.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-398920.65% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2024-75310.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2021-35721.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-444320.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2025-146880.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-91710.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2024-120861.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 77% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [high] IBM WebSphere Application Server and Application Server Liberty: Multiple vulnerabilitiescert-bund
- medium[NEW] [medium] IBM WebSphere Application Server: Multiple vulnerabilities enable Denial of Servicecert-bund
- high[UPDATE] [high] IBM WebSphere Application Server: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian productsncsc-nl
- high[UPDATE] [high] Red Hat Enterprise Linux and Satellite (satellite/iop-remediations-rhel9 container image): Mul…cert-bund
- unknownexploitedMultiple vulnerabilities in IBM products (August 21, 2026)cert-fr-avis
- high[NEW] [high] Splunk SOAR: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Splunk products (20 August 2026)cert-fr-avis
- highexploited[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnera…cert-bund
- unknownNCSC-2026-0309 [1.00] [M/H] Vulnerabilities resolved in Oracle Communicationsncsc-nl
- high[NEW] [HIGH] Oracle Communications: Multiple Vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Oracle MySQL (August 19, 2026)cert-fr-avis
Recent advisories for IBM products
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownexploitedMultiple vulnerabilities in IBM products (August 21, 2026)cert-fr-avis · 2026-08-21
- unknownexploitedMultiple vulnerabilities in IBM products (August 14, 2026)cert-fr-avis · 2026-08-14
- unknownIBM WebSphere Products Multiple Vulnerabilitieshkcert · 2026-08-13
- highCVE-2026-13433: IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unve…nvd · 2026-08-12
- unknownMultiple vulnerabilities in IBM products (August 07, 2026)cert-fr-avis · 2026-08-07
- unknownMultiple vulnerabilities in IBM products (July 31, 2026)cert-fr-avis · 2026-07-31
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Keycloak (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in Cisco IOS XE (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in LibreNMS (August 24, 2026)2026-08-24
- unknownMultiple vulnerabilities in Metabase (August 24, 2026)2026-08-24
- unknownVulnerability in SPIP (August 21, 2026)2026-08-21