Skip to content
Sign in
8.2 High

CVE-2026-10025 IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE)…

Description

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.

Affected products and versions

Product Affected versions Fixed in
QRadar 7.6 7.6.0.0 → 7.6.0.1 No fix stated
QRadar 7.5 7.5.0 → latest No fix stated

Other CVEs of QRadar

The 22 CVEs of QRadar →
CVE-2026-93442 IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a… 8.2 High CVE-2025-33141 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information… 6.5 Medium CVE-2026-5522 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic… 6.7 Medium CVE-2026-13477 IBM QRadar SIEM is vulnerable to remote code execution by privileged users 4.7 Medium
Track this CVE