IBM CVE-2025-13995

The CVSS 3.1 vector (AV:N/AC:L/PR:L/S:C/C:L/I:N/A:N) indicates a network-accessible vulnerability with low attack complexity and low privilege requirements, with impact scoped across multiple tenants. The confidentiality impact is rated as low (C:L), reflecting limited data exposure (hostnames only) rather than full system compromise. The base CVSS score of 5.0 places this in the medium range, but real-world risk depends on deployment context: in a shared multi-tenant QRadar instance with diverse customers, this is a material compliance and confidentiality concern; in isolated single-tenant deployments, the practical risk is minimal. The lack of active exploitation indicators (no KEV status noted, no public POC) and availability of a vendor patch reduce immediate urgency, but the low attack complexity and low privilege requirement mean this is likely to be discovered and exploited opportunistically by malicious insiders or compromised low-privilege accounts. Organizations using QRadar in multi-tenant SaaS or managed security service provider (MSSP) contexts should prioritize patching over those in isolated environments.

An attacker gains standard user credentials for a QRadar tenant (either through credential compromise or by being a legitimate low-privilege user). The attacker then crafts API requests or uses the QRadar UI to query or enumerate hostname data, manipulating tenant identifiers or bypassing tenant validation checks. Because the attack requires only network access and valid (low-privilege) authentication with low complexity, a malicious insider or attacker with a compromised account can perform reconnaissance on other tenants' infrastructure to map targets for further attacks, exfiltrate hostname lists for social engineering, or identify high-value systems in competing organizations sharing the same QRadar instance.