EUVD-2026-53441
GHSA-v25c-c5f5-pwx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach QRadar syslog port 514
-
DeliverySend crafted XML syslog event
-
ExploitparseXmlPayload resolves external entity
-
ExecutionRead local file or trigger SSRF
-
ImpactExfiltrate disclosed data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that at least one QRadar log source type is configured to use XML-format property autodetection - this is the concrete enabling condition and it is not the universal default, so environments without XML autodetection are not exposed via this path. When that condition holds, the attacker needs only network reachability to the syslog collector on port 514 (UDP or TCP); no authentication (PR:N) and no user interaction (UI:N) are required, and the payload is a crafted XML-formatted syslog event. Limiting factors: the non-default XML-autodetection configuration and network reachability to port 514, which is often restricted to internal/trusted log sources rather than exposed to the internet. |
| Impact | Signals are mixed. The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H) reflects an unauthenticated network-reachable parser, but CISA's SSVC framework rates Technical Impact as only 'partial' and Exploitation as 'none', which conflicts with the 'total' C/I/A in the CVSS vector - XXE realistically yields high confidentiality (file/SSRF) but limited integrity and availability impact, so the true severity is likely somewhat below 9.8. Automatable is 'yes' per SSVC, meaning mass exploitation is feasible if a POC emerges, yet EPSS is only 0.32% (25th percentile) and there is no KEV listing and no public POC, indicating no observed exploitation to date. A meaningful limiting factor is that exploitation requires at least one log source type configured for XML-format property autodetection, which is not universal - this materially reduces the exposed population versus a default-config network flaw. Net: a real, patch-worthy issue for QRadar operators using XML autodetection, but not an emergency on par with actively exploited CVEs. |
| Exploit ScenarioDerived | An attacker who can reach the QRadar syslog listener sends a UDP or TCP packet to port 514 containing an XML-formatted event whose DOCTYPE defines an external entity pointing at a local file (e.g. /etc/passwd or credentials/config files) or an internal URL. When a log source type with XML autodetection parses the payload, the resolved entity content is disclosed or an internal request is made, and no authentication or user interaction is required. No public POC is known at time of analysis, but the low attack complexity and unauthenticated network vector make weaponization straightforward if the XML autodetection precondition is met. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 10, 2026
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Earlier versions of this analysis (1)
XXE injection in IBM QRadar's core event processing pipeline exposes SIEM infrastructure to unauthenticated remote file reads via crafted syslog events. The parseXmlPayload() function in q1labs_core.jar processes XML-formatted syslog input on port 514 (UDP/TCP) without authentication when any log source type is configured with XML-format property autodetection, enabling external entity resolution against local server files. No active exploitation has been identified at time of analysis and no public exploit code is known, but the unauthenticated network vector against a platform that centralizes security telemetry gives this vulnerability elevated real-world consequence.
RemediationAI
Apply the IBM-released fix referenced in advisory https://www.ibm.com/support/pages/node/7282394 (Patch available per vendor advisory; consult that node for the exact interim fix/build for your 7.5.0 or 7.6.0 branch, as an exact fixed version string is not provided in the intelligence data). Until patched, the most targeted compensating control is to disable XML-format property autodetection on any log source type that does not require it, which removes the code path into parseXmlPayload() at the cost of losing automatic XML property extraction for those sources. Additionally, restrict inbound access to the syslog collector on port 514 (UDP/TCP) using network segmentation, firewall ACLs, or an allow-list of trusted log-source IPs so that arbitrary hosts cannot deliver crafted XML events - the trade-off is that any legitimate but non-allow-listed sender will be blocked and must be enumerated first. Monitor QRadar for malformed XML events and outbound connections from the event processor that could indicate SSRF.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-611 (Improper Restriction of XML External Entity Reference) in the q1labs_core.jar event-processing component. QRadar is IBM's enterprise SIEM platform that ingests syslog/event data from many log sources; when a log source type is set to XML-format property autodetection, incoming syslog payloads on port 514 are handed to parseXmlPayload(), which parses attacker-controlled XML. If the underlying Java XML parser resolves external entities and DOCTYPE declarations, an attacker can define entities that reference local files (file://), internal URLs (SSRF), or recursively expand (billion-laughs DoS). The single affected CPE is cpe:2.3:a:ibm:qradar, and the trust boundary is crossed at the unauthenticated syslog listener rather than a web interface.
Know when Qradar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated XML on port 514 gives AV:N/AC:L/PR:N; XXE yields high confidentiality (file/SSRF) but no real integrity impact and only DoS-level availability, matching SSVC 'partial'.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.
Executive ViewAI
IBM QRadar SIEM versions 7.5.0 through 7.6.0.1 contain a critical XML injection vulnerability enabling unauthenticated remote attackers to access sensitive files, manipulate internal traffic, or disable security monitoring. Organizations using affected QRadar versions face direct operational risk to their primary security detection platform and incident response capabilities. Immediate patching is required to prevent potential blind-spot scenarios in threat detection.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys
IBM QRadar deployments running 7.5.0 through 7.5.0 UP15 Interim Fix 006 expose sensitive backup-file contents to any hol
Exploit-DB