CVE-2026-10025
8.2 HIGHPublished 2026-08-05 · Updated 2026-08-10
AI risk analysis
- Summary
- The flaw is an XML External Entity (XXE) injection vulnerability in IBM QRadar, allowing unauthorized access to sensitive information through improperly processed XML-formatted syslog events.
- Exploitability
- Exploitation is relatively easy if an attacker can send XML-formatted syslog events to the QRadar system on port 514 without authentication. Precondition is that at least one log source type is configured to use XML-format property autodetection.
- Blast radius
- If exploited, the vulnerability could lead to the exposure of sensitive information, potentially impacting the security and confidentiality of the system and its data.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Disable XML-format property autodetection for all log sources or upgrade to IBM QRadar 7.6.0.2 or later.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weaknesses
CWE-611
Vendors
ibm
Products
qradar security information and event manager
References
- https://www.ibm.com/support/pages/node/7282394 Vendor Advisory
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.