EUVD-2026-53439
GHSA-h2q5-8jvm-53gq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description specifies 'privileged user,' warranting PR:H; network vector and no user interaction confirmed; scope unchanged as commands execute on the same system.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.
AnalysisAI
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
Technical ContextAI
IBM QRadar is a widely-deployed enterprise Security Information and Event Management (SIEM) platform, identified in CPE as cpe:2.3:a:ibm:qradar. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection), meaning the application passes user-supplied data to an underlying system shell without adequate sanitization or metacharacter escaping. QRadar's backend typically runs on Linux and performs administrative and diagnostic operations via shell calls, making configuration or management input fields a plausible attack surface. An attacker who controls an authenticated privileged session can append shell metacharacters to inputs that are interpreted by the OS, causing execution of unintended commands.
RemediationAI
Apply the vendor-released patch documented in the IBM security advisory at https://www.ibm.com/support/pages/node/7282395; the precise remediated version number is not independently confirmed in the available data and must be retrieved directly from IBM before planning the upgrade. While awaiting patching, restrict QRadar privileged account access to the minimum number of vetted administrators and enforce multi-factor authentication on all QRadar operator and admin accounts to reduce the risk of credential compromise enabling exploitation. Network-level controls - specifically, firewall rules limiting access to the QRadar management interface and API to known administrative IP ranges - can meaningfully reduce exposure in environments where patching is delayed. Anomaly monitoring for unexpected OS-level process spawns originating from QRadar application processes can serve as a compensating detective control, given that SSVC flags this as non-automatable.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1)
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today