EUVD-2026-71257
GHSA-cr73-ww7m-4x5r
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Local high-privilege access required to extract embedded credentials; S:C reflects credential reuse potential across QRadar components; C:H for SIEM data exposure, I:L for limited downstream modification, A:N for no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
AnalysisAI
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local, high-privileged (administrative or root-level) access to the QRadar host per CVSS AV:L/PR:H - the attacker must already be able to inspect application binaries or configuration files on the system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.7 base score with AV:L and PR:H means exploitation is bounded to attackers already holding administrative or root-level access on the QRadar host, substantially constraining the attack surface to insiders or post-initial-compromise lateral movement scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch per IBM security advisory at https://www.ibm.com/support/pages/node/7285277; the exact patched version build is not independently specified in available public data beyond the fix being confirmed available through IBM Support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1)
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today