IBM Patches High-Severity Flaws in Langflow, Application Gateway, QRadar, and WebSphere

IBM released security updates for multiple products after disclosures covering at least 21 high-severity vulnerabilities across Langflow OSS, Application Gateway Operator, QRadar, and WebSphere Application Server. The issues span remote code execution, arbitrary file read/write, information disclosure, security restriction bypass, and server-side request forgery, with national CERT and CSIRT notices urging organizations to apply IBM’s bulletins and upgrade affected deployments.

Among the disclosed flaws, CVE-2026-17624 affects IBM Langflow OSS versions 1.0.0 through 1.10.3 and allows a remote authenticated attacker to execute arbitrary code through improper validation of module imports in component generation, validation, and custom component handling. CVE-2026-17617 affects IBM Application Gateway Operator versions 22.2.0 through 26.06 and enables SSRF through insufficient validation of URLs in custom resources; additional affected products include QRadar 7.6.0.1 and earlier in the 7.6.x branch, QRadar 7.5.0 UP 15 IF05 and earlier in the 7.5.x branch, WebSphere Application Server 8.5 and 9.0, and **WebSphere Liberty Continuous Delivery`.