Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to Improper Verification of Cryptographic Signature.

Summary netty-handler-4.2.13.Final.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-50010. Vulnerability Details CVEID:CVE-2026-50010 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.0 Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period...

Security Bulletin: Multiple Vulnerabilities in IBM Event Processing

Summary Multiple vulnerabilities were addressed. Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-1933 DESCRIPTION: A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks,...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities due to Angular [CVE-2026-50170, CVE-2026-50171, CVE-2026-54266, CVE-2026-54268, CVE-2026-50557, CVE-2026-52725, CVE-2026-54267, CVE-2026-54265]

Summary The IBM Db2 Mirror for i GUI uses the Angular web framework. The version of Angular used by IBM Db2 Mirror for i is vulnerable to leaking information by transferring cache state to the client-side application CVE-2026-50170 and using a weak hash function for the server-side cached respons...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting due to Angular [CVE-2026-32635, CVE-2026-27970]

Summary The IBM Db2 Mirror for i GUI uses the Angular web framework. The version of Angular used by IBM Db2 Mirror for i is vulnerable to cross-site scripting as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-32635 DESCRIPTION: Angular is a development platfo...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple Netty vulnerabilities (CVE-2026-45673, CVE-2026-45674, CVE-2026-47691)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-45673, CVE-2026-45674, CVE-2026-47691. Vulnerability Details CVEID:CVE-2026-45673 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an HTTP Request/Response Smuggling Vulnerability in Netty (CVE-2026-50020)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-50020. Vulnerability Details CVEID:CVE-2026-50020 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Resource Allocation Vulnerability in Netty (CVE-2026-45416)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-45416. Vulnerability Details CVEID:CVE-2026-45416 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an HTTP Request/Response Splitting Vulnerability in Netty (CVE-2026-42578)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42578. Vulnerability Details CVEID:CVE-2026-42578 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is is susceptible to multiple Netty vulnerabilities CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585. Vulnerability Details CVEID:CVE-2026-42580 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an Improper Input Validation Vulnerability in Netty (CVE-2026-42579)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD for network communication. CVE-2026-42579. Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec...

Security Bulletin: Multiple vulnerabilities has been identified in IBM WebSphere Application Server which is used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple Vulnerabilities affect IBM License Metric Tool v9

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-38969 DESCRIPTION: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that...

Security Bulletin: Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36298)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability in Ebics server Vulnerability Details CVEID:CVE-2025-36298 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway Ebics server component is vulnerable to cross-site scripting. This...

Security Bulletin: Security Vulnerability in EdDSA-Java affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2020-36843)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to EdDSA-Java's implementation of the cryptographic algorithm. Vulnerability Details CVEID:CVE-2020-36843 DESCRIPTION: The implementation of EdDSA in EdDSA-Java aka ed25519-java through 0.3.0 exhibi...

Security Bulletin: TS4500 CLI tool addresses security vulnerability CVE-2026-16107

Summary The TS4500 CLI tool used an insecure SSL configuration that did not properly validate server certificates, potentially allowing attackers to intercept communications through a Man-in-the-Middle MitM attack. The issue has been resolved by enforcing proper SSL certificate validation during...

Security Bulletin: This Power System update is being released to address CVE-2026-7868

Summary This impacts the BMC's HTTPS interface for BMC ReadOnly user accounts. Vulnerability Details CVEID:CVE-2026-7868 DESCRIPTION: OPENBMC allows ReadOnly users to escalate privileges and give themselves administrator privileges. CWE:CWE-863: Incorrect Authorization CVSS Source: IBM CVSS Base...

Security Bulletin: This Power System update is being released to address CVE-2026-8058

Summary The BMC's diagnostic interface is affected. Vulnerability Details CVEID:CVE-2026-8058 DESCRIPTION: OPENBMC allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it. CWE:CWE-200: Exposure of Sensitive...

Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within IBM HTTP Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration...

Security Bulletin: This Power System update is being released to address CVE-2026-4932

Summary A firmware issue was identified where the generated AES key used to initialize the Transparent Memory Encryption TME hardware has weakened encryption strength. Vulnerability Details CVEID:CVE-2026-4932 DESCRIPTION: PowerVM Hypervisor could allow an attacker with physical access to the...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j. Even though Rhapsody risk impact was low We have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appende...

Security Bulletin: This Power System update is being released to address CVE-2026-11885

Summary A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise system or OS memory integrity. Vulnerability Details CVEID:CVE-2026-11885 DESCRIPTION: A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory...

Security Bulletin: Vulnerabilities in Apache Tomcat affect IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products

Summary Vulnerabilities in Apache Tomcat affect the product's management GUI could cause confidentiality, integrity and availability impacts. The CLI is unaffected. CVE-2025-48976 CVE-2025-48988 CVE-2025-49125 CVE-2025-53506 CVE-2025-52434 CVE-2025-55752 CVE-2025-61795. Vulnerability Details...

Security Bulletin: Vulnerability in netty-codec-http affects IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in netty-codec-http affects IBM Storage Virtualize products and could cause an integrity impact. CVE-2025-67735. Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final...

Security Bulletin: Vulnerabilities in multiple components affect IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in openssh, libssh, kernel and gnutls components affect IBM Storage Virtualize products and could cause confidentiality, integrity and availability impacts. CVE-2026-35387 CVE-2026-35414 CVE-2025-5372 CVE-2022-50865 CVE-2025-39971 CVE-2025-14831. Vulnerability Details...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary The following CVEs in the OS kernel may affect IBM DataPower Gateway Vulnerability Details CVEID:CVE-2025-38180 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against devlec...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary postgresql-42.7.11.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54291. Vulnerability Details CVEID:CVE-2026-54291 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-web-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data...

Security Bulletin: Multiple vulnerabilities in IBM Controller

Summary Multiple vulnerabilities were addressed in IBM Controller. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-0540)

Summary DOMPurify is used by the UI component of IBM DataPower Gateway Vulnerability Details CVEID:CVE-2026-0540 DESCRIPTION: DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute...

Security Bulletin: IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent, is affected by a security vulnerability in Perl

Summary IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent and has remediated a vulnerability in the Zlib library. Vulnerability Details CVEID:CVE-2026-4176 DESCRIPTION: Perl versions from 5.9.4 before 5.40.4-RC1, from...

Security Bulletin: Code injection, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to code injection, cross-site scripting, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features that...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.16 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in log4j-core (CVE-2026-34479)

Summary IBM® Db2® federated server is affected by a vulnerability in log4j-core. Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in OpenSSL

Summary Multiple vulnerabilities in OpenSSL that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-22796 DESCRIPTION: Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary The following CVEs in the OS kernel may affect IBM DataPower Gateway Vulnerability Details CVEID:CVE-2024-26984 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel agains...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 11 used by IBM Installation Manager and IBM Packaging Utility. Vulnerability Details CVEID:CVE-2025-53057 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow a remot...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version 5.4.0 Vulnerability Details CVEID:CVE-2026-35469 DESCRIPTION: spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 fram...

Security Bulletin: Vulnerability in IBM Data Product Hub

Summary A vulnerability was addressed in IBM Data Product Hub version 5.4.0 Patch 1 Vulnerability Details CVEID:CVE-2026-25087 DESCRIPTION: Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow I...

Security Bulletin: IBM DataPower Gateway vulnerable to memory corruption in OS kernel (CVE-2023-53178)

Summary IBM DataPower Gateway vulnerable to memory corruption in OS kernel CVE-2023-53178 Vulnerability Details CVEID:CVE-2023-53178 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a ra...

Security Bulletin: Security vulnerability has been detected in IBM Security Verify Governance Identity Manager Adapters

Summary IBM Security Verify Governance Identity Manager Adapters are affected by a security vulnerability in the jackson-core-3.1.0.jar component Vulnerability Details ID:WS-2026-0010 DESCRIPTION: Jackson Core 3.x does not consistently enforce StreamReadConstraints.maxDocumentLength. Oversized JS...

Security Bulletin: IBM Maximo Application Suite uses yaml-2.7.0.tgz which is vulnerable to CVE-2026-33532.

Summary IBM Maximo Application Suite uses yaml-2.7.0.tgz which is vulnerable to CVE-2026-33532. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-33532 DESCRIPTION: yaml is a YAML parser and serialiser for JavaScript. Parsing a YA...

Security Bulletin: Multiple vulnerabilities in IBM Guardium Unified Discovery and Classification (GUDC) container images

Summary Security vulnerabilities have been addressed in the IBM Guardium Unified Discovery and Classification GUDC container images Vulnerability Details CVEID:CVE-2025-0167 DESCRIPTION: When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password use...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.13.0 Vulnerability Details CVEID:CVE-2023-5752 DESCRIPTION: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision...

Security Bulletin: IBM Cognos Analytics 12.1.3 general availability package contains a data integrity issue in the Agentic AI assistant that may cause incorrect report summaries or report-processing errors under concurrent use (CVE-2026-15995)

Summary The IBM Cognos Analytics 12.1.3 general availability package contains a data integrity issue in the Agentic AI assistant used by authorized analysts to query report summaries and perform related tasks. Under certain concurrent usage conditions, when two authenticated users submit the same...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability (CVE-2026-10842)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability with the appSecurity-1.0, appSecurity-2.0 , appSecurity-3.0 or appSecurity-4.0 feature enabled. Vulnerability Details CVEID:CVE-2026-10842 DESCRIPTION: IBM WebSphere...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3...