IBM QRadar SIEM CVE-2025-36170

Exploitation requires an authenticated QRadar SIEM Web UI account with at least low privileges (PR:L) to store the malicious payload, and a separate victim user must subsequently view the affected Web UI page for the stored JavaScript to execute (UI:R) - the payload does not fire against an attacker-only session. Affected scope is IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02. Limiting factors that reduce real-world risk: the attacker needs valid credentials to the QRadar console (not an external/anonymous attacker), a privileged victim must interact with the stored content for credential disclosure to occur, and impact is confined to the browser session rather than the underlying host (A:N, no availability impact).

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity stored XSS that nonetheless requires an authenticated low-privileged account (PR:L) AND victim interaction (UI:R), which materially constrains real-world exploitability. The scope change (S:C) and credential-disclosure angle in a trusted session are the reasons this rates MEDIUM rather than LOW. The exploitation-probability signals all point low-risk: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified, so there is no public exploit identified at time of analysis. These signals are consistent rather than conflicting - low EPSS, no KEV, and no POC together indicate a vulnerability that is real but not under active or widespread exploitation. No SSVC decision data was provided in the input, so automatable/technical-impact classification cannot be stated. Net: a legitimate patch-management item for QRadar operators, but not a drop-everything issue absent evidence of active exploitation.

An authenticated QRadar user with low privileges injects a malicious JavaScript payload into a stored field in the Web UI. When a higher-privileged analyst or administrator later views the affected page, the script executes in their authenticated browser session, enabling theft of session credentials or UI manipulation within that trusted session. No public exploit code is known, and successful attack depends on a privileged victim viewing the poisoned content (UI:R).