Read the docs
TI-2026-11403 Aliases CVE-2026-13477GHSA-h2q5-8jvm-53gq

IBM QRadar SIEM is vulnerable to remote code execution by privileged users

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00492 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMQRadar7.6.0.0 – 7.6.0.1; 7.5.0 – 7.5.0 UP 15 Interim Fix 005—No fix listedCNA
  • QRadar VendorIBM Affected 7.6.0.0 – 7.6.0.1; 7.5.0 – 7.5.0 UP 15 Interim Fix 005 Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*7.5.0VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*7.5.0 update_pack_1VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*7.5.0 update_pack_10VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*7.5.0 update_pack_11VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*7.5.0 update_pack_12VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*7.5.0 update_pack_13VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:*7.5.0 update_pack_13_interim_fix_01VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:*7.5.0 update_pack_13_interim_fix_02VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*7.5.0 update_pack_14VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_01:*:*:*:*:*:*7.5.0 update_pack_14_interim_fix_01VulnerableIBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:* Versions 7.5.0 update_pack_1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:* Versions 7.5.0 update_pack_10 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:* Versions 7.5.0 update_pack_11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:* Versions 7.5.0 update_pack_12 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:* Versions 7.5.0 update_pack_13 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:* Versions 7.5.0 update_pack_13_interim_fix_01 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:* Versions 7.5.0 update_pack_13_interim_fix_02 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:* Versions 7.5.0 update_pack_14 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_01:*:*:*:*:*:* Versions 7.5.0 update_pack_14_interim_fix_01 Vulnerable ·IBM
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_02:*:*:*:*:*:*7.5.0 update_pack_14_interim_fix_02VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15:*:*:*:*:*:*7.5.0 update_pack_15VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_01:*:*:*:*:*:*7.5.0 update_pack_15_interim_fix_01VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_02:*:*:*:*:*:*7.5.0 update_pack_15_interim_fix_02VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_03:*:*:*:*:*:*7.5.0 update_pack_15_interim_fix_03VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_04:*:*:*:*:*:*7.5.0 update_pack_15_interim_fix_04VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*7.5.0 update_pack_2VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*7.5.0 update_pack_3VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*7.5.0 update_pack_4VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*7.5.0 update_pack_5VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*7.5.0 update_pack_6VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*7.5.0 update_pack_7VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*7.5.0 update_pack_8VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*7.5.0 update_pack_9VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:-:*:*:*:*:*:*7.6.0VulnerableIBM
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:fix_pack_1:*:*:*:*:*:*7.6.0 fix_pack_1VulnerableIBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_02:*:*:*:*:*:* Versions 7.5.0 update_pack_14_interim_fix_02 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15:*:*:*:*:*:* Versions 7.5.0 update_pack_15 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_01:*:*:*:*:*:* Versions 7.5.0 update_pack_15_interim_fix_01 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_02:*:*:*:*:*:* Versions 7.5.0 update_pack_15_interim_fix_02 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_03:*:*:*:*:*:* Versions 7.5.0 update_pack_15_interim_fix_03 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_04:*:*:*:*:*:* Versions 7.5.0 update_pack_15_interim_fix_04 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:* Versions 7.5.0 update_pack_2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:* Versions 7.5.0 update_pack_3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:* Versions 7.5.0 update_pack_4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:* Versions 7.5.0 update_pack_5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:* Versions 7.5.0 update_pack_6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:* Versions 7.5.0 update_pack_7 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:* Versions 7.5.0 update_pack_8 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:* Versions 7.5.0 update_pack_9 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:-:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:fix_pack_1:*:*:*:*:*:* Versions 7.6.0 fix_pack_1 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13477
  2. 2026-10-03 Alias added: GHSA-h2q5-8jvm-53gq
  3. 2026-11-03 CISA SSVC decision points changed

References

Patch 1

  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-03687 Deserialization of untrusted data in IBM QRadar SIEM CVSS 3.1HIGH 8.8
  • TI-2020-04118 Deserialization of untrusted data in IBM QRadar SIEM CVSS 3.1HIGH 8.8
  • TI-2018-01304 Improper authentication in IBM Security QRadar SIEM CVSS 3.0HIGH 8.8
  • TI-2018-01442 Information disclosure in IBM QRadar SIEM CVSS 3.0MEDIUM 5.8
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences