Security Bulletin: Security vulnerabilities in Logback affect IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-10532 , CVE-2026-9828)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core module...

Atlassian Confluence 6.6.x < 9.2.24 / 9.3.x < 10.2.17 / 11.0.0 (CONFSERVER-104474)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104474 advisory. - ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications,...

Security Bulletin: Multiple vulnerabilties in DevOps Test Hub

Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 11.0.9 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all...

RHLW-2026-A08954EF69E23D40 Lightwell Security Advisory: logback-core 1.2.11.rhlw-00001

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.11.rhlw-00001 with backported fixes for CVE-2023-6378, CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-10532, CVE-2026-1225, and CVE-2026-9828. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12798: ACE...

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albei...

RHLW-2026-055D7BDE52D9946F Lightwell Security Advisory: logback-core 1.2.12.rhlw-00005

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.12.rhlw-00005 with backported fixes for CVE-2023-6378 and CVE-2024-12801. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12801: Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream) - Object Injection Possible

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream)

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc (crlsa-2019_2720)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20192720 advisory. jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution CVE-2019-12384 Tenable has extracted the...

RHLW-2026-07E5370D09E5A6F8 Lightwell Security Advisory: logback-core 1.5.9.rhlw-00031

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880. CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0...

ROOT-APP-MAVEN-CVE-2021-42550 CVE-2021-42550 in ch.qos.logback:logback-core - Patched by Root

Root has patched CVE-2021-42550 in the ch.qos.logback:logback-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-1225 CVE-2026-1225 in ch.qos.logback:logback-core - Patched by Root

Root has patched CVE-2026-1225 in the ch.qos.logback:logback-core package for Root:Maven. Multiple fixed versions available...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091415)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091415 advisory. FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorph...

RHLW-2026-666A4E7D1066F856 Lightwell Security Advisory: logback-core 1.5.16.rhlw-00002

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.16.rhlw-00002 with a backported security fix. CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.16 from Maven Central...

Security Bulletin: A vulnerability in logback-core-1.3.14.jar found in IBM Devops Code ClearCase

Summary A vulnerability in logback-core-1.3.14.jar found in IBM Devops Code ClearCase CVE-2026-9828 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Obje...

Security Bulletin: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core

Summary Upgrade to new jsonListener.jar Vulnerability Details CVEID:CVE-2026-13006 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway Desktop Edition, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback Classic, Log4j API, and Jackson Databind. To address thes...

Security Bulletin: Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management

Summary Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management have been addressed Vulnerability Details CVEID:CVE-2026-1225 DESCRIPTION: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java...

Security Bulletin: Security Vulnerability in logback-core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-1225)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to logback-core Vulnerability Details CVEID:CVE-2026-1225 DESCRIPTION: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java...