Loading story…
German advisory service dCERT published alerts on multiple vulnerabilities affecting IBM QRadar SIEM, indicating that the security information and event management platform is impacted by more than one flaw requiring attention. The advisories, identified as 2026-0532 and 2026-1639, both describe the issue as IBM QRadar SIEM: Multiple Vulnerabilities.
The repeated publication of advisories on the same product suggests ongoing vulnerability tracking or updated disclosure activity around QRadar SIEM. Organizations using IBM QRadar SIEM should review the referenced dCERT advisories and corresponding IBM guidance to determine affected versions, assess exposure, and prioritize remediation for any vulnerable deployments.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT later published advisory 2026-1639 concerning multiple vulnerabilities in IBM QRadar SIEM. The provided references do not specify whether these are newly disclosed issues or an update to earlier reporting.
dCERT published advisory 2026-0532 for IBM QRadar SIEM, identifying multiple vulnerabilities affecting the product. This is the earliest referenced disclosure in the provided material.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued two advisories covering **multiple vulnerabilities** in **IBM App Connect Enterprise**, indicating ongoing security issues affecting the enterprise integration platform. The advisories, `2026-0874` and `2026-0987`, both identify IBM App Connect Enterprise as the impacted product, though no public synopsis was provided in the referenced notices. The repeated publication of advisories for the same IBM product suggests organizations using App Connect Enterprise should review the associated vendor and dCERT guidance, identify affected versions, and prioritize patching or other mitigations. Security teams should also assess exposure in environments where the platform handles critical application and data flows, as vulnerabilities in integration middleware can create broad operational and security risk.
Jun 29, 2026
IBM released security updates for multiple products after disclosures covering at least 21 high-severity vulnerabilities across **Langflow OSS**, **Application Gateway Operator**, **QRadar**, and **WebSphere Application Server**. The issues span remote code execution, arbitrary file read/write, information disclosure, security restriction bypass, and server-side request forgery, with national CERT and CSIRT notices urging organizations to apply IBM’s bulletins and upgrade affected deployments. Among the disclosed flaws, `CVE-2026-17624` affects **IBM Langflow OSS** versions `1.0.0` through `1.10.3` and allows a remote authenticated attacker to execute arbitrary code through improper validation of module imports in component generation, validation, and custom component handling. `CVE-2026-17617` affects **IBM Application Gateway Operator** versions `22.2.0` through `26.06` and enables SSRF through insufficient validation of URLs in custom resources; additional affected products include **QRadar** `7.6.0.1` and earlier in the `7.6.x` branch, **QRadar** `7.5.0 UP 15 IF05` and earlier in the `7.5.x` branch, **WebSphere Application Server** `8.5` and `9.0`, and **WebSphere Liberty Continuous Delivery`.
Aug 8, 2026
CISA released a series of Industrial Control System (ICS) security advisories addressing vulnerabilities in a wide range of products from vendors such as Advantech, Axis Communications, Hitachi Energy, Inductive Automation, Johnson Controls, Mitsubishi Electric, National Instruments, Rockwell Automation, Schneider Electric, and Siemens. These advisories urge administrators to review mitigation steps and apply available updates to protect critical infrastructure systems from potential exploitation. Separately, IBM published security advisories for multiple enterprise products, including IBM API Connect, CloudPak for AIOps, DataPower Gateway, Db2, QRadar Suite, and Watson services, among others. The advisories highlight critical updates and recommend immediate patching to address identified vulnerabilities. Both CISA and IBM emphasize the importance of timely remediation to reduce risk exposure in operational and enterprise environments.
Jun 29, 2026