EUVD-2026-53441
GHSA-v25c-c5f5-pwx9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated XML on port 514 gives AV:N/AC:L/PR:N; XXE yields high confidentiality (file/SSRF) but no real integrity impact and only DoS-level availability, matching SSVC 'partial'.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.
AnalysisAI
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Technical ContextAI
The flaw is a classic CWE-611 (Improper Restriction of XML External Entity Reference) in the q1labs_core.jar event-processing component. QRadar is IBM's enterprise SIEM platform that ingests syslog/event data from many log sources; when a log source type is set to XML-format property autodetection, incoming syslog payloads on port 514 are handed to parseXmlPayload(), which parses attacker-controlled XML. If the underlying Java XML parser resolves external entities and DOCTYPE declarations, an attacker can define entities that reference local files (file://), internal URLs (SSRF), or recursively expand (billion-laughs DoS). The single affected CPE is cpe:2.3:a:ibm:qradar, and the trust boundary is crossed at the unauthenticated syslog listener rather than a web interface.
RemediationAI
Apply the IBM-released fix referenced in advisory https://www.ibm.com/support/pages/node/7282394 (Patch available per vendor advisory; consult that node for the exact interim fix/build for your 7.5.0 or 7.6.0 branch, as an exact fixed version string is not provided in the intelligence data). Until patched, the most targeted compensating control is to disable XML-format property autodetection on any log source type that does not require it, which removes the code path into parseXmlPayload() at the cost of losing automatic XML property extraction for those sources. Additionally, restrict inbound access to the syslog collector on port 514 (UDP/TCP) using network segmentation, firewall ACLs, or an allow-list of trusted log-source IPs so that arbitrary hosts cannot deliver crafted XML events - the trade-off is that any legitimate but non-allow-listed sender will be blocked and must be enumerated first. Monitor QRadar for malformed XML events and outbound connections from the event processor that could indicate SSRF.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys
Share
External POC / Exploit Code
Leaving vuln.today