IBM QRadar CVE-2026-13477

Exploitation requires an authenticated session holding privileged QRadar credentials - the description explicitly identifies 'authenticated privileged user,' implying at minimum QRadar operator-level access and potentially administrator-level access; the exact minimum role is not specified and should be confirmed in the IBM advisory. The attacker must reach the QRadar web interface or API over the network and interact with the specific input-accepting endpoint that fails to sanitize OS command metacharacters. Execution is constrained to normal user privilege level on the host OS, limiting the blast radius to what that OS account can access and ruling out direct root-level compromise via this flaw alone. Exploitation is bounded to the affected version range (7.5.0 through 7.5.0 UP 15 IF 005 and 7.6.0.0 through 7.6.0.1); SSVC rates Automatable as 'no,' indicating that scripted or wormable mass exploitation is unlikely.

The NVD-assigned CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network-accessible, low-complexity exploitation with only low privileges required. However, the vulnerability description explicitly states 'authenticated privileged user,' directly conflicting with the PR:L metric - this discrepancy should be verified against IBM's advisory at https://www.ibm.com/support/pages/node/7282395. If high privileges are genuinely required, the realistic CVSS score would be approximately 7.2, reducing priority. EPSS at 0.22% (13th percentile) is notably low for a High-severity flaw, indicating minimal threat actor interest at time of analysis. SSVC corroborates: Exploitation is 'none,' Automatable is 'no,' and Technical Impact is rated 'partial' - the last point also conflicts with CVSS C:H/I:H/A:H triple-high impact and remains unresolved. Overall, real-world priority is meaningfully lower than the raw CVSS score implies: this is an insider-threat or compromised-admin scenario on a SIEM, not a candidate for mass or automated exploitation.

A QRadar administrator or operator, either acting with malicious intent or operating from a compromised account, submits crafted input containing shell metacharacters to a vulnerable QRadar management function that fails to sanitize values before passing them to an OS command. The injected commands execute on the underlying Linux host at normal user privilege level, enabling the attacker to read sensitive SIEM data, exfiltrate security event logs, or attempt lateral movement to systems accessible from the QRadar host. No public proof-of-concept code has been identified at time of analysis.