Qradar Security Information And Event Manager CVE-2025-33121

CVSS 7.1 reflects a moderate-to-high severity: network-accessible (AV:N), low attack complexity (AC:L), but requires authentication (PR:L), with high confidentiality impact and low availability impact. The PR:L requirement significantly reduces real-world risk compared to an unauthenticated XXE. The vulnerability affects a privileged user base (QRadar administrators or operators with credentials), limiting the threat actor pool. Without confirmed EPSS data, KEV listing, or public POCs, this appears to be a post-disclosure vulnerability requiring active monitoring rather than an imminent zero-day threat. However, QRadar's role as a SIEM makes any information disclosure particularly serious—attackers could exfiltrate security event logs, configuration data, or credentials stored in QRadar. The XXE attack surface is well-understood and exploitable by moderate-skill attackers once inside the authentication boundary.

An authenticated QRadar operator or a threat actor with compromised credentials submits a specially crafted XML file via QRadar's API or log ingestion endpoint. The malicious XML contains a DOCTYPE declaration with an external entity reference pointing to /etc/passwd or other sensitive files: <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><data>&xxe;</data>. The vulnerable XML parser processes the entity without restriction, causing the parser to read the referenced file and either: (a) return its contents in an error message or response, exposing sensitive data, or (b) trigger billion-laughs attack patterns that consume memory, degrading QRadar performance. No public POC has been widely disseminated, but XXE exploitation is a standard technique in penetration testing frameworks (e.g., Burp Suite).