Loading story…
IBM disclosed several security issues affecting products across its portfolio, including IBM Cloud Databases for PostgreSQL, WebSphere Application Server, Liberty, IBM HTTP Server, and IBM Security Guardium. The referenced advisories indicate exposure to widely tracked vulnerabilities such as the OpenSSL certificate parsing flaws CVE-2022-3786 and CVE-2022-3602, alongside a Guardium command execution issue tracked as CVE-2023-35893.
The notices show IBM assessing and publishing product-specific impact information through support bulletins and X-Force Exchange reporting, with Guardium highlighted for command execution risk and other enterprise offerings reviewed for inherited third-party component exposure. The disclosures underscore the need for organizations using affected IBM platforms to verify product impact, review vendor bulletins, and apply available fixes or mitigations to reduce the risk of exploitation in database, application server, web server, and data security environments.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
IBM X-Force Exchange published a vulnerability report for IBM Security Guardium command execution flaw CVE-2023-35893. This marks a later technical reporting event for the vulnerability in IBM's exchange portal.
IBM published a support notice stating that IBM Cloud Databases for PostgreSQL was affected by a security vulnerability. The reference does not provide additional incident details beyond the disclosure.
IBM published support guidance on whether WebSphere Application Server, Liberty, and IBM HTTP Server were affected by the OpenSSL vulnerabilities CVE-2022-3786 and CVE-2022-3602.
IBM published a security bulletin/blog post addressing a potential CPU security issue. The reference indicates this disclosure occurred on the publication date of the bulletin.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
exchange.xforce.ibmcloud.com
Open sourceibm.com
Open sourceibm.com
Open sourceibm.com
Open sourceibm.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM released security updates for multiple products after disclosures covering at least 21 high-severity vulnerabilities across **Langflow OSS**, **Application Gateway Operator**, **QRadar**, and **WebSphere Application Server**. The issues span remote code execution, arbitrary file read/write, information disclosure, security restriction bypass, and server-side request forgery, with national CERT and CSIRT notices urging organizations to apply IBM’s bulletins and upgrade affected deployments. Among the disclosed flaws, `CVE-2026-17624` affects **IBM Langflow OSS** versions `1.0.0` through `1.10.3` and allows a remote authenticated attacker to execute arbitrary code through improper validation of module imports in component generation, validation, and custom component handling. `CVE-2026-17617` affects **IBM Application Gateway Operator** versions `22.2.0` through `26.06` and enables SSRF through insufficient validation of URLs in custom resources; additional affected products include **QRadar** `7.6.0.1` and earlier in the `7.6.x` branch, **QRadar** `7.5.0 UP 15 IF05` and earlier in the `7.5.x` branch, **WebSphere Application Server** `8.5` and `9.0`, and **WebSphere Liberty Continuous Delivery`.
Aug 8, 2026
IBM disclosed multiple vulnerabilities in **WebSphere Application Server** and **WebSphere Application Server Liberty**, including denial-of-service issues tracked as `CVE-2026-9071` and `CVE-2026-9320`, and an HTTP request smuggling flaw, `CVE-2026-8646`, rated up to **CVSS 8.1**. The affected products include WebSphere Application Server **8.5** and **9.0**, along with WebSphere Liberty versions **17.0.0.3 through 26.0.0.6** when certain servlet or websocket features are enabled. IBM said no workarounds or mitigations are available and advised customers to apply interim fixes for **APAR PH71631** and **PH71370** or upgrade to fix packs **26.0.0.7**, **9.0.5.29**, or **8.5.5.30**. A related high-severity issue, `CVE-2026-9072`, affects **IBM i 7.3 through 7.6** in environments using WebSphere Application Server or Liberty with **Intelligent Management** and the **WebSphere WebServer Plug-in**. IBM said an attacker who can impersonate backend servers and send crafted responses to the plug-in could trigger **remote code execution** and **denial of service**, also with a **CVSS 8.1** rating. Recommended actions include installing the latest WebSphere security updates, updating IBM i to current levels, and reviewing the secure configuration of Intelligent Management and the WebSphere WebServer Plug-in.
Jun 29, 2026
IBM disclosed multiple high-severity vulnerabilities affecting **WebSphere** and **webMethods Integration Server**, exposing enterprise middleware environments to remote compromise. In WebSphere, the reported issues include remote code execution flaws tracked as `CVE-2026-9311`, `CVE-2026-9330`, and `CVE-2026-9319`, alongside an authentication bypass and identity spoofing issue, `CVE-2026-8644`. Affected deployments include traditional WebSphere versions **9.0** and **8.5**, with IBM issuing interim fixes through specific APARs and urging administrators to verify configurations and apply patches quickly. A separate IBM advisory covers **webMethods Integration Server** `CVE-2025-36072`, a deserialization-based remote code execution flaw that can be exploited by an authenticated attacker with service execution privileges through internal APIs or protocols such as `IDataBin`. The vulnerability affects versions **10.11** through `10.11_Core_Fix22`, **10.15** through `10.15_Core_Fix22`, and **11.1** through `11.1_Core_Fix6` if they have not received the latest core fixes. Successful exploitation could allow arbitrary code execution in the Integration Server process, enabling lateral movement, persistence, and data exfiltration across business-critical systems.
Jun 29, 2026