IBM EUVD-2026-13041

The CVSS 3.1 base score of 5.4 reflects a medium-severity vulnerability with network-accessible attack vector (AV:N), low attack complexity (AC:L), and requirement for low-privilege authentication (PR:L). The attack requires user interaction (UI:R), meaning a victim must view a page containing the malicious payload. The scope is changed (S:C), indicating impact beyond the vulnerable component. Confidentiality and integrity are low (C:L, I:L) but availability is not affected (A:N). While CVSS assigns a moderate rating, the real-world risk is contextualized by three critical factors: (1) QRadar SIEM is a high-value target that aggregates security telemetry and controls critical security operations, (2) the vulnerability requires authentication but not high privilege, making it exploitable by tier-1 SOC analysts or junior administrators, and (3) credential disclosure risk is explicitly mentioned, suggesting the vulnerability can be weaponized to harvest sensitive authentication tokens. The SSVC framework would classify this as having limited automatable impact (user interaction required) but potentially significant technical impact in a security operations context where stolen credentials could escalate to administrative access. Without public EPSS data or KEV status confirmation, exploitation likelihood appears low in the wild, but the vulnerability remains a priority for QRadar deployments due to environmental risk.

An authenticated QRadar analyst receives a phishing email or is socially engineered to visit a malicious URL containing an XSS payload (e.g., crafted QRadar Web UI search parameter with JavaScript). When the analyst clicks the link while logged into QRadar, the injected script executes in their browser session, silently exfiltrating their session token or authentication cookie to an attacker-controlled server. The attacker then uses the stolen credential to impersonate the analyst, accessing QRadar dashboards and potentially modifying correlation rules, disabling alerts, or accessing sensitive log data. The low attack complexity and network accessibility make this a viable social engineering attack against security teams.