Cyber Centre Daily Advisory Digest — 2026-09-15 (4 advisories)
The Canadian Cyber Centre published advisories for critical vulnerabilities in IBM MQ, GNU libextractor, Mozilla Firefox, and Docker Sandboxes requiring immediate patching. Advisories cover critical patch deployments for IBM, GNU, Mozilla, and Docker products. IBM MQ has a remote code execution flaw and Sterling File Gateway has an access control bypass. GNU libextractor and Mozilla Firefox require updates to prevent memory corruption and browser exploitation.
Detection / Hunteropenrouter
Immediate Actions
- Apply IBM security patches for MQ and Sterling File Gateway immediately.
- Update Mozilla Firefox and Firefox ESR to latest versions.
- Update Docker Sandboxes to version 0.43.0 or later.
- Update GNU libextractor to version 1.15 or later.
Key Takeaways
- IBM MQ vulnerable to remote code execution via CVE-2026-13293.
- IBM Sterling File Gateway vulnerable to improper access control via CVE-2026-19290.
- GNU libextractor vulnerable to stack overflow via OLE2 processing.
- Docker Sandboxes affected by an unspecified vulnerability prior to version 0.43.0.
Attack Chain
- Initial Access: Exploit vulnerable IBM MQ or Sterling File Gateway exposed to the internet
- Execution: Trigger remote code execution via incomplete security scanner blocklist (CVE-2026-13293)
- Persistence: Establish foothold using unauthorized access from improper access control (CVE-2026-19290)
- Defense Evasion: Deliver malicious OLE2 files to trigger stack overflow in libextractor
Affected Systems
- IBM MQ versions 10.0.0.0 and prior LTS/CD releases
- IBM Sterling File Gateway 6.2.x
- GNU libextractor prior to v1.15
- Mozilla Firefox prior to 156
- Mozilla Firefox ESR prior to 115.41, 140.16, 153.3
- Docker Sandboxes prior to 0.43.0
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-13293 | IBM MQ | Remote code execution via incomplete security scanner blocklist. | |
| CVE-2026-19290 | IBM Sterling File Gateway | Improper access control vulnerability. | |
| CVE-2026-91752 | GNU libextractor | Stack overflow triggered via OLE2 processing. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect post-exploitation execution following exploitation of public-facing applications. |
| Network Visibility | High | Network monitoring can identify exploit attempts against IBM MQ and Sterling File Gateway. |
| Detection Difficulty | Hard | Exploitation of these vulnerabilities may not generate distinct signatures without vendor-specific rules. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for unexpected child processes spawning from IBM MQ or Sterling File Gateway services (T1190). | EDR process telemetry and service logs | Execution | Low — legitimate service spawning shells is rare |
| Hunt for network traffic patterns indicating exploitation attempts against public-facing IBM services (T1190). | Network firewall and IDS logs | Initial Access | Medium — vulnerability scanners may trigger similar alerts |
Required Log Sources
- Web application firewall logs
- Endpoint detection and response telemetry
- IBM MQ audit logs
- DNS and HTTP logs
Key Behavioral Indicators
- Unexpected child processes from IBM MQ services
- Anomalous access patterns in Sterling File Gateway
- Crash events in GNU libextractor processing OLE2 files
Control Gaps
- WAF rulesets lacking coverage for CVE-2026-13293
- Lack of network segmentation for IBM MQ infrastructure
False Positive Assessment
Low — Exploitation of these specific CVEs against public-facing services is highly suspicious and rarely legitimate.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict external access to IBM MQ and Sterling File Gateway interfaces.
- Implement network segmentation for critical messaging infrastructure.
- Deploy virtual patches at WAF for CVE-2026-13293 and CVE-2026-19290.
User Protection
- Force automatic updates for Mozilla Firefox browsers.
- Block OLE2 files from untrusted sources if libextractor cannot be patched.
MITRE ATT&CK Mapping
Initial Access
Execution
Plain-Language Summary
The Canadian government issued security alerts for several popular software products. IBM, GNU, Mozilla, and Docker released updates to fix security holes that could allow attackers to execute malicious code or gain unauthorized access. Administrators and users should update these applications to the latest versions immediately to protect their systems.
- cveCVE-2026-13293Remote code execution via incomplete security scanner blocklist.
- cveCVE-2026-19290Improper access control vulnerability.
- cveCVE-2026-91752Stack overflow triggered via OLE2 processing.