Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Resource Allocation Vulnerability in Netty (CVE-2026-45416)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-45416. Vulnerability Details CVEID:CVE-2026-45416 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an HTTP Request/Response Splitting Vulnerability in Netty (CVE-2026-42578)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42578. Vulnerability Details CVEID:CVE-2026-42578 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is is susceptible to multiple Netty vulnerabilities CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585. Vulnerability Details CVEID:CVE-2026-42580 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an Improper Input Validation Vulnerability in Netty (CVE-2026-42579)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42579. Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec...

Security Bulletin: Multiple vulnerabilities has been identified in IBM WebSphere Application Server which is used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple Vulnerabilities affect IBM License Metric Tool v9

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-38969 DESCRIPTION: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that...

Security Bulletin: Security Vulnerability in commons-lang affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-48924)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to commons-lang library. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...

Security Bulletin: Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36298)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability in Ebics server Vulnerability Details CVEID:CVE-2025-36298 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway Ebics server component is vulnerable to cross-site scripting. This...

Security Bulletin: Security Vulnerability in logback affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-11226)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to logback libraries. Vulnerability Details CVEID:CVE-2025-11226 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18...

Security Bulletin: Security Vulnerability in EdDSA-Java affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2020-36843)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to EdDSA-Java's implementation of the cryptographic algorithm. Vulnerability Details CVEID:CVE-2020-36843 DESCRIPTION: The implementation of EdDSA in EdDSA-Java aka ed25519-java through 0.3.0 exhibi...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI (CVE-2026-3157)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure in mailbox UI. Vulnerability Details CVEID:CVE-2026-3157 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway is vulnerable to an information disclosure d...

Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-5115)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Jetty Vulnerability Details CVEID:CVE-2025-5115 DESCRIPTION: In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, =12.1.0.alpha2, an HTTP/2 client may trigger the server to send...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVE-2026-3159)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure. Vulnerability Details CVEID:CVE-2026-3159 DESCRIPTION: IBM IBM Sterling File Gateway is vulnerable to an information disclosure due to sensitive information being included...

Security Bulletin: TS4500 CLI tool addresses security vulnerability CVE-2026-16107

Summary The TS4500 CLI tool used an insecure SSL configuration that did not properly validate server certificates, potentially allowing attackers to intercept communications through a Man-in-the-Middle MitM attack. The issue has been resolved by enforcing proper SSL certificate validation during...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVE-2026-3158)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure Vulnerability Details CVEID:CVE-2026-3158 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway is vulnerable to an information disclosure due to sensitive...

Security Bulletin: Security Vulnerability in IBM WebSphere Application Server - Liberty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-14917)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to IBM WebSphere Application Server - Liberty Vulnerability Details CVEID:CVE-2025-14917 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application...

Security Bulletin: Security Vulnerability in Apache Shiro affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-23901, CVE-2026-23903)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Shiro Vulnerability Details CVEID:CVE-2026-23901 DESCRIPTION: Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1., 2. before 2.0.7. Users...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file (CVE-2026-1918)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to sensitive information in a log file. Vulnerability Details CVEID:CVE-2026-1918 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway stores potentially sensitive information in l...

Security Bulletin: Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-66675)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Struts Vulnerability Details CVEID:CVE-2025-66675 DESCRIPTION: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issu...

Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-11143)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Jetty. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing ...

Security Bulletin: Security Vulnerability in Apache Zookeeper affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-24281 CVE-2026-24308)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Zookeeper Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails,...

Security Bulletin: Security Vulnerability in logback-core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-1225)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to logback-core Vulnerability Details CVEID:CVE-2026-1225 DESCRIPTION: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java...

Security Bulletin: Security Vulnerability in Netty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-67735)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Netty Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the...

Security Bulletin: Security Vulnerability in WebSphere Application Server Liberty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-12635)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2025-12635 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 throu...

Security Bulletin: Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-64775)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Struts Vulnerability Details CVEID:CVE-2025-64775 DESCRIPTION: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issu...

Security Bulletin: XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36431)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability. Vulnerability Details CVEID:CVE-2025-36431 DESCRIPTION: IBM Sterling File Gateway is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip...

Security Bulletin: Security Vulnerability in Spring Boot affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22731 CVE-2026-22733)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring Boot Vulnerability Details CVEID:CVE-2026-22731 DESCRIPTION: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoi...

Security Bulletin: Security Vulnerability in Spring affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22737)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring. Vulnerability Details CVEID:CVE-2026-22737 DESCRIPTION: Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in...

Security Bulletin: Security Vulnerability in Netty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-33870 CVE-2026-33871)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Netty Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty...

Security Bulletin: This Power System update is being released to address CVE-2026-7868

Summary This impacts the BMC's HTTPS interface for BMC ReadOnly user accounts. Vulnerability Details CVEID:CVE-2026-7868 DESCRIPTION: OPENBMC allows ReadOnly users to escalate privileges and give themselves administrator privileges. CWE:CWE-863: Incorrect Authorization CVSS Source: IBM CVSS Base...

Security Bulletin: This Power System update is being released to address CVE-2026-8058

Summary The BMC's diagnostic interface is affected. Vulnerability Details CVEID:CVE-2026-8058 DESCRIPTION: OPENBMC allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it. CWE:CWE-200: Exposure of Sensitive...

Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within IBM HTTP Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration...

Security Bulletin: This Power System update is being released to address CVE-2026-4932

Summary A firmware issue was identified where the generated AES key used to initialize the Transparent Memory Encryption TME hardware has weakened encryption strength. Vulnerability Details CVEID:CVE-2026-4932 DESCRIPTION: PowerVM Hypervisor could allow an attacker with physical access to the...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j. Even though Rhapsody risk impact was low We have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appende...

Security Bulletin: This Power System update is being released to address CVE-2026-11885

Summary A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise system or OS memory integrity. Vulnerability Details CVEID:CVE-2026-11885 DESCRIPTION: A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory...

Security Bulletin: Vulnerabilities in Apache Tomcat affect IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products

Summary Vulnerabilities in Apache Tomcat affect the product's management GUI could cause confidentiality, integrity and availability impacts. The CLI is unaffected. CVE-2025-48976 CVE-2025-48988 CVE-2025-49125 CVE-2025-53506 CVE-2025-52434 CVE-2025-55752 CVE-2025-61795. Vulnerability Details...

Security Bulletin: Vulnerability in netty-codec-http affects IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in netty-codec-http affects IBM Storage Virtualize products and could cause an integrity impact. CVE-2025-67735. Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final...

Security Bulletin: Vulnerabilities in multiple components affect IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in openssh, libssh, kernel and gnutls components affect IBM Storage Virtualize products and could cause confidentiality, integrity and availability impacts. CVE-2026-35387 CVE-2026-35414 CVE-2025-5372 CVE-2022-50865 CVE-2025-39971 CVE-2025-14831. Vulnerability Details...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary The following CVEs in the OS kernel may affect IBM DataPower Gateway Vulnerability Details CVEID:CVE-2025-38180 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against devlec...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary postgresql-42.7.11.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54291. Vulnerability Details CVEID:CVE-2026-54291 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-web-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data...

Security Bulletin: Multiple vulnerabilities in IBM Controller

Summary Multiple vulnerabilities were addressed in IBM Controller. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-0540)

Summary DOMPurify is used by the UI component of IBM DataPower Gateway Vulnerability Details CVEID:CVE-2026-0540 DESCRIPTION: DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute...

Security Bulletin: IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent, is affected by a security vulnerability in Perl

Summary IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent and has remediated a vulnerability in the Zlib library. Vulnerability Details CVEID:CVE-2026-4176 DESCRIPTION: Perl versions from 5.9.4 before 5.40.4-RC1, from...

Security Bulletin: Code injection, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to code injection, cross-site scripting, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features that...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.16 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in log4j-core (CVE-2026-34479)

Summary IBM® Db2® federated server is affected by a vulnerability in log4j-core. Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in OpenSSL

Summary Multiple vulnerabilities in OpenSSL that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-22796 DESCRIPTION: Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union...