CVE-2026-10025CWE-611xxe

CVE-2026-10025

High · published August 5, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00646 · 50.3th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-08-05T20:16Z
Affected products (26)
ProductVersionsFixed in
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
ibm/qradar_security_information_and_event_managerall versions—
References (1)
https://www.ibm.com/support/pages/node/7282394 · [email protected]
EPSS history
Timeline
  • 05 AUG 16:03Z
    IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
    cvelistv5