IBM QRadar SIEM CVE-2025-36138

Exploitation requires (1) a valid authenticated QRadar account (PR:L) with access to a Web UI input field that persists data, and (2) a second trusted user - typically a SOC analyst or administrator - subsequently loading the page containing the stored payload (UI:R). These two prerequisites substantially limit exploitation: an anonymous or external attacker cannot trigger it directly, and the payload remains dormant until a victim views it. Affected scope is IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02; environments on a fixed build are not exposed. Because QRadar accounts are generally held only by trusted security personnel, the practical attacker population is small, though an insider or a compromised low-privilege account satisfies the authentication requirement.

This is a moderate-risk, high-CVSS-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 Medium) shows network reach and low complexity but requires an already-authenticated user (PR:L) AND victim interaction (UI:R) - meaning an authenticated attacker must plant the payload and a separate trusted user must then view it. The scope change (S:C) reflects that injected script executes in the victim's browser session rather than only the attacker's context, which is why confidentiality/integrity are rated Low rather than None. Real-world risk signals are consistently low: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. The signals do not conflict - a low EPSS aligns with the absence of KEV/POC and the dual precondition (authentication plus user interaction). Net assessment: a legitimate stored-XSS flaw worth patching in a security-sensitive product, but not an emergency; it should be prioritized behind unauthenticated or actively-exploited vulnerabilities. Note that because QRadar is itself a SIEM administered by privileged security staff, a successful session-credential theft could be impactful despite the modest score.

An authenticated QRadar user with access to a UI field that persists input stores a crafted JavaScript payload. When another trusted user (e.g., a SOC analyst or administrator) later views the affected Web UI page, the script executes in their authenticated session, potentially exfiltrating session credentials or tokens. No public exploit code was identified at time of analysis, and exploitation requires both valid authentication and victim interaction.