IBM QRadar SIEM EUVD-2026-106860

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required: a remote attacker needs only network reachability to an exposed IBM QRadar SIEM service to attempt exploitation. The description does not name a specific feature, protocol, port, or non-default configuration as a precondition, so the limiting factors are primarily network exposure (QRadar consoles/collectors are often segmented on internal management networks rather than internet-facing) and the specific affected version range, which is not disclosed in the provided data and must be confirmed against IBM advisory node 7292244. Impact is limited to availability - no data disclosure or integrity loss - so successful exploitation disrupts SIEM monitoring but does not directly compromise data.

The IBM-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) describes a remotely reachable, low-complexity, unauthenticated denial-of-service with high availability impact and a scope change, which on paper is a serious signal for an always-on security appliance. However, the real-world risk signals are thin and partly uncorroborated: there is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis. The impact is confined to availability (C:N/I:N) - this is a crash/exhaustion issue, not data theft or code execution - which lowers its practical priority relative to its headline score. One notable tension is the S:C (scope changed) rating: for a self-contained resource-exhaustion DoS this is aggressive, since uncontrolled resource consumption (CWE-400) typically degrades only the affected QRadar component rather than a separately-authorized downstream system; verify the scope justification with IBM advisory node 7292244. Net assessment: a credible availability threat to internet- or network-reachable QRadar deployments that should be patched on a normal-to-expedited cycle, but not an emergency on the level of an actively-exploited RCE given the DoS-only impact and absence of any exploitation evidence.

A remote attacker with network reach to the QRadar SIEM sends a stream of specially crafted or high-volume requests that trigger uncontrolled resource consumption (CPU, memory, or connection/thread exhaustion), degrading or crashing the service. Because no authentication or user interaction is required (PR:N/UI:N), any attacker able to reach the exposed service can attempt it. No public proof-of-concept is identified in the provided data.