Qradar
Monthly
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
IBM QRadar deployments running 7.5.0 through 7.5.0 UP15 Interim Fix 006 expose sensitive backup-file contents to any holder of a valid QRadar account, because those backup files are stored with incorrect permissions. Exploitation requires authentication (CVSS vector PR:L) but no administrative rights and no user interaction, and an attacker who satisfies that bar can read configuration, credential, or event data captured in the affected backups, yielding a high confidentiality impact (C:H) with no integrity or availability effect. This is a moderate-priority information-disclosure issue rather than a high-urgency emergency: no public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and the authentication prerequisite plus the need for an unpatched interim-fix level are the principal limiting factors.
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. IBM has issued a patch via advisory 7285277; no public exploit code or CISA KEV listing exists at time of analysis.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1) lets remote unauthenticated attackers submit crafted XML-formatted syslog events to the parseXmlPayload() function in the event-processing pipeline. When any log source type uses XML-format property autodetection, events arriving on port 514 (UDP/TCP) are parsed without authentication, enabling file disclosure, SSRF, and denial of service. No public exploit identified at time of analysis, but EPSS is a low 0.32% (25th percentile) and IBM has published a fix.
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal user privilege level due to insufficient input validation (CWE-78). Affected versions span QRadar 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1, placing enterprise security operations centers at risk if SIEM operator accounts are compromised or misused by insiders. No public exploit code exists and no active exploitation is confirmed; EPSS places this at the 13th percentile (0.22%), indicating minimal near-term mass-exploitation probability.
IBM QRadar deployments running 7.5.0 through 7.5.0 UP15 Interim Fix 006 expose sensitive backup-file contents to any holder of a valid QRadar account, because those backup files are stored with incorrect permissions. Exploitation requires authentication (CVSS vector PR:L) but no administrative rights and no user interaction, and an attacker who satisfies that bar can read configuration, credential, or event data captured in the affected backups, yielding a high confidentiality impact (C:H) with no integrity or availability effect. This is a moderate-priority information-disclosure issue rather than a high-urgency emergency: no public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and the authentication prerequisite plus the need for an unpatched interim-fix level are the principal limiting factors.
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. IBM has issued a patch via advisory 7285277; no public exploit code or CISA KEV listing exists at time of analysis.