Qradar
Monthly
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. IBM has issued a patch via advisory 7285277; no public exploit code or CISA KEV listing exists at time of analysis.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. IBM has issued a patch via advisory 7285277; no public exploit code or CISA KEV listing exists at time of analysis.