IBM QRadar SIEM CVE-2025-36007

Exploitation requires pre-existing low-privileged authenticated local access to the QRadar SIEM host (CVSS PR:L, AV:L) and the presence of the vulnerable update script on affected builds - IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02. The vulnerability is in how privileges are assigned to that update script, so the limiting factors are significant: there is no remote or network vector, no unauthenticated path, and the attacker must already be on the appliance. This makes it a post-compromise or malicious-insider escalation primitive rather than an initial-access flaw, which materially lowers realistic risk relative to the 7.8 base score.

This is a genuine but contained risk, not an internet-facing emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a LOCAL privilege escalation: an attacker already needs low-level authenticated access (PR:L) to the QRadar host before the flaw is useful, so there is no network-reachable attack surface here despite the HIGH base score. The CWE-266 (Incorrect Privilege Assignment) root cause and the description's reference to an improperly-privileged update script are mutually consistent - a low-privileged local account can abuse the script to gain full compromise (C:H/I:H/A:H, i.e. root/admin). The exploitation-probability signals all point the same way and reinforce the 'contained' reading: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified. No SSVC decision data was supplied in the input, so automatable/technical-impact framing cannot be cited. Bottom line: this is a legitimate patch-worthy escalation on a security-critical appliance, but it is a second-stage/post-access issue rather than a widely-exploited remote threat. No data conflicts were observed - the CVSS vector, CWE, and description agree that access is local and privileged.

An attacker who has already obtained a low-privileged local shell on a QRadar SIEM host (via stolen operator credentials, a prior foothold, or an insider) invokes or manipulates the improperly-privileged update script to execute actions as a higher-privileged user, resulting in full administrative/root control of the SIEM. No public exploit code was identified at time of analysis, and because the appliance is a central security-monitoring platform, successful escalation could let the attacker tamper with or disable logging and detection.