Read the docs
TI-2016-07892 Aliases CVE-2016-9726GHSA-pc86-8x4w-cr47

Improper input validation in IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7…

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542.

Why it matters now

EPSS 0.02343 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7, 7.1 MR2, 7.2.3IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7, 7.1 MR2, 7.2.3—No fix listedCNA
  • IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7, 7.1 MR2, 7.2.3 Vendor— Affected IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7, 7.1 MR2, 7.2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.1:*:*:*:*:*:*:*7.2.1VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.2:*:*:*:*:*:*:*7.2.2VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.3:*:*:*:*:*:*:*7.2.3VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.4:*:*:*:*:*:*:*7.2.4VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.5:*:*:*:*:*:*:*7.2.5VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.6:*:*:*:*:*:*:*7.2.6VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.7:*:*:*:*:*:*:*7.2.7VulnerableIBM
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:*:*:*:*:*:*:*7.2.8VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableIBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.1:*:*:*:*:*:*:* Versions 7.2.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.2:*:*:*:*:*:*:* Versions 7.2.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.3:*:*:*:*:*:*:* Versions 7.2.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.4:*:*:*:*:*:*:* Versions 7.2.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.5:*:*:*:*:*:*:* Versions 7.2.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.6:*:*:*:*:*:*:* Versions 7.2.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.7:*:*:*:*:*:*:* Versions 7.2.7 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:*:*:*:*:*:*:* Versions 7.2.8 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·IBM
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:*:*:*:*:*:*:*7.2.1VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:*:*:*:*:*:*:*7.2.2VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:*:*:*:*:*:*:*7.2.3VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:*:*:*:*:*:*:*7.2.4VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:*:*:*:*:*:*:*7.2.5VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:*:*:*:*:*:*:*7.2.6VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:*:*:*:*:*:*:*7.2.7VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:*:*:*:*:*:*:*7.2.8VulnerableIBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:*:*:*:*:*:*:* Versions 7.2.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:*:*:*:*:*:*:* Versions 7.2.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:*:*:*:*:*:*:* Versions 7.2.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:*:*:*:*:*:*:* Versions 7.2.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:*:*:*:*:*:*:* Versions 7.2.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:*:*:*:*:*:*:* Versions 7.2.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.7:*:*:*:*:*:*:* Versions 7.2.7 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:*:*:*:*:*:*:* Versions 7.2.8 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9726
  2. 2026-10-03 Alias added: GHSA-pc86-8x4w-cr47

References

Patch 1

  • TI-2016-07893 Improper input validation in IBM QRadar SIEM CVSS 3.0HIGH 8.5
  • TI-2018-01464 Path traversal in IBM QRadar Incident Forensics CVSS 3.0HIGH 7.7
  • TI-2018-01462 Resource allocation without limits in IBM QRadar Incident Forensics CVSS 3.0HIGH 7.5
  • TI-2025-24095 IBM QRadar SIEM privilege escalation CVSS 3.1HIGH 7.8
  • TI-2018-01463 IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could… CVSS 3.0HIGH 7.5
  • TI-2017-01343 Path traversal in IBM Security QRadar SIEM CVSS 3.0MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences