XML External Entity injection in IBM QRadar SIEM (CVE-2026-10025)

IBM QRadar SIEM contains an XXE injection vulnerability in the `parseXmlPayload()` function within the event processing pipeline (`q1labs_core.jar`). When XML-format property autodetection is enabled on at least one log source type, the system processes XML-formatted syslog events received on port 514 (UDP/TCP) without authentication, allowing a network-adjacent attacker to exploit the flaw. Successful exploitation may result in high-impact disclosure of sensitive information and limited availability impact. Affected versions: - 7.6.0.0 - 7.6.0.1 - 7.5.0 - 7.5.0 UP 15 IF05 We recommend updating to: 7.6.0.2, 7.5.0 UP15 IF05 Hotfix 20260715231428. CVSS 9.8 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7282394 Details: https://vuln.today/cve/CVE-2026-10025