Loading story…
IBM released security updates for multiple products after disclosures covering at least 21 high-severity vulnerabilities across Langflow OSS, Application Gateway Operator, QRadar, and WebSphere Application Server. The issues span remote code execution, arbitrary file read/write, information disclosure, security restriction bypass, and server-side request forgery, with national CERT and CSIRT notices urging organizations to apply IBM’s bulletins and upgrade affected deployments.
Among the disclosed flaws, CVE-2026-17624 affects IBM Langflow OSS versions 1.0.0 through 1.10.3 and allows a remote authenticated attacker to execute arbitrary code through improper validation of module imports in component generation, validation, and custom component handling. CVE-2026-17617 affects IBM Application Gateway Operator versions 22.2.0 through 26.06 and enables SSRF through insufficient validation of URLs in custom resources; additional affected products include QRadar 7.6.0.1 and earlier in the 7.6.x branch, QRadar 7.5.0 UP 15 IF05 and earlier in the 7.5.x branch, WebSphere Application Server 8.5 and 9.0, and **WebSphere Liberty Continuous Delivery`.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE history states that IBM PSIRT newly received CVE-2026-17624 on August 5, 2026. The flaw is an arbitrary code execution issue in IBM Langflow OSS affecting versions 1.0.0 through 1.10.3.
The CVE record states that IBM PSIRT newly received CVE-2026-17617 on August 5, 2026. The vulnerability is an SSRF issue in IBM Application Gateway Operator affecting versions 22.2.0 through 26.06.
IBM released security updates covering multiple vulnerabilities across Langflow OSS, Application Gateway Operator, QRadar, and WebSphere Application Server. The notice says 21 of the vulnerabilities are high severity and recommends updating affected products according to IBM security bulletins.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecert.gov.py
Open sourcecert.gov.py
Open sourcecert.gov.py
Open sourcecert.gov.py
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM released security updates for critical and high-severity vulnerabilities affecting **Langflow OSS**, **IBM MQ**, and **IBM Sterling File Gateway**. Langflow OSS versions 1.0.0 through 1.10.0 are vulnerable to `CVE-2026-12944` (CVSS 9.6), where an incomplete dangerous-import blocklist can let authenticated users submit components that make network connections during server-side validation. Exploitation could enable SSRF against cloud metadata services, reverse shells, file exfiltration, access to internal Docker services, and code execution as root; IBM recommends upgrading to Langflow OSS 1.10.1. IBM MQ's JMS client is affected by `CVE-2026-13293` (CVSS 8.8), a Java deserialization allowlist-bypass flaw that can allow an authenticated remote attacker to execute arbitrary code when a target consumes JMS ObjectMessages. IBM also addressed nine vulnerabilities across MQ middleware releases, including critical `CVE-2026-11381` and high-severity `CVE-2026-11375` and `CVE-2026-11378`, which may permit authenticated remote code execution, as well as `CVE-2026-11726`, which may expose protected information. Updates are available for supported IBM MQ 9.1 through 9.4 LTS releases; Continuous Delivery and IBM MQ 10.0 users should move to 10.0.0.5. Separately, `CVE-2026-19290` (CVSS 7.5) allows unauthenticated remote access to sensitive information in Sterling File Gateway versions 6.2.0.0–6.2.0.6_1, 6.2.1.0–6.2.1.2, and 6.2.2.0–6.2.2.1; customers should apply APAR `IT49875` by upgrading to 6.2.0.6_2, 6.2.1.2_1, or 6.2.2.1_1. No workarounds were provided, and IBM had not reported active exploitation of the MQ flaws.
Sep 16, 2026
IBM disclosed multiple severe vulnerabilities in **Langflow OSS** affecting versions `1.0.0` through `1.10.1`, including remote code execution, denial of service, path traversal, unauthorized file and vector store access, build job information disclosure, and exposed credentials through unauthenticated or insufficiently authorized API endpoints. The most prominent issue, **`CVE-2026-13446`**, is a hard-coded credentials flaw classified as **CWE-798** and scored **CVSS 9.8**, creating a network-exploitable path to compromise confidentiality, integrity, and availability. According to IBM's bulletin, the vulnerable endpoints could let attackers execute code, read arbitrary files, access secrets, modify other users' data, and cancel active builds without proper authorization. IBM advised users to upgrade Langflow OSS to **`1.10.2`** to remediate the issues, as the affected releases expose both application internals and connected external components to critical compromise.
Jul 18, 2026
IBM disclosed multiple vulnerabilities in **WebSphere Application Server** and **WebSphere Application Server Liberty**, including denial-of-service issues tracked as `CVE-2026-9071` and `CVE-2026-9320`, and an HTTP request smuggling flaw, `CVE-2026-8646`, rated up to **CVSS 8.1**. The affected products include WebSphere Application Server **8.5** and **9.0**, along with WebSphere Liberty versions **17.0.0.3 through 26.0.0.6** when certain servlet or websocket features are enabled. IBM said no workarounds or mitigations are available and advised customers to apply interim fixes for **APAR PH71631** and **PH71370** or upgrade to fix packs **26.0.0.7**, **9.0.5.29**, or **8.5.5.30**. A related high-severity issue, `CVE-2026-9072`, affects **IBM i 7.3 through 7.6** in environments using WebSphere Application Server or Liberty with **Intelligent Management** and the **WebSphere WebServer Plug-in**. IBM said an attacker who can impersonate backend servers and send crafted responses to the plug-in could trigger **remote code execution** and **denial of service**, also with a **CVSS 8.1** rating. Recommended actions include installing the latest WebSphere security updates, updating IBM i to current levels, and reviewing the secure configuration of Intelligent Management and the WebSphere WebServer Plug-in.
Jun 29, 2026