CVE-2025-33120: IBM QRadar SIEM privilege escalation

Q: What is the severity of CVE-2025-33120?

CVE-2025-33120 is considered a medium severity vulnerability that allows privilege escalation in IBM QRadar SIEM.

Q: How do I fix CVE-2025-33120?

To fix CVE-2025-33120, reconfigure the affected cronjob to ensure it does not execute with unnecessary privileges.

Q: Who is affected by CVE-2025-33120?

IBM QRadar SIEM versions 7.5 through 7.5.0 UP13 are affected by CVE-2025-33120.

Q: What type of vulnerability is CVE-2025-33120?

CVE-2025-33120 is a privilege escalation vulnerability due to a misconfigured cronjob.

Q: Can unprivileged users exploit CVE-2025-33120?

Yes, an authenticated unprivileged user could exploit CVE-2025-33120 to escalate their privileges.

Published Aug 21, 2025

Updated

IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges.

Other sources

IBM QRadar SIEM could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges.

— IBM

Affected Software

30 affected components

IBM QRadar SIEM<=7.5 - 7.5.0 UP13

IBM QRadar SIEM>=7.5<=7.5.0 UP13

IBM QRadar Incident Forensics=7.5.0

IBM QRadar Incident Forensics=7.5.0-update_pack_1

IBM QRadar Incident Forensics=7.5.0-update_pack_10

IBM QRadar Incident Forensics=7.5.0-update_pack_11

IBM QRadar Incident Forensics=7.5.0-update_pack_12

IBM QRadar Incident Forensics=7.5.0-update_pack_13

IBM QRadar Incident Forensics=7.5.0-update_pack_2

IBM QRadar Incident Forensics=7.5.0-update_pack_3

IBM QRadar Incident Forensics=7.5.0-update_pack_4

IBM QRadar Incident Forensics=7.5.0-update_pack_5

IBM QRadar Incident Forensics=7.5.0-update_pack_6

IBM QRadar Incident Forensics=7.5.0-update_pack_7

IBM QRadar Incident Forensics=7.5.0-update_pack_8

IBM QRadar Incident Forensics=7.5.0-update_pack_9

IBM QRadar Security Information and Event Manager=7.5.0

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_1

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_10

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_11

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_12

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_13

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_2

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_3

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_4

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_5

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_6

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_7

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_8

IBM QRadar Security Information and Event Manager=7.5.0-update_pack_9

Remediation

Information

IBM encourages customers to update their systems promptly. ProductVersionFixIBM QRadar SIEM 7.5.0 QRadar 7.5.0 UP13 IF01 https://www.ibm.com/support/fixcentral/swg/selectFixes QRadar Incident Forensics 7.5.0 QIF 7.5.0 UP13 IF01 https://www.ibm.com/support/fixcentral/swg/selectFixes

Event History

Aug 21, 2025

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Aug 22, 2025

CVE Published

via MITRE·02:54 PM

Data Sourced

via MITRE·02:54 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7242869

Frequently Asked Questions

What is the severity of CVE-2025-33120?

CVE-2025-33120 is considered a medium severity vulnerability that allows privilege escalation in IBM QRadar SIEM.

How do I fix CVE-2025-33120?

To fix CVE-2025-33120, reconfigure the affected cronjob to ensure it does not execute with unnecessary privileges.

Who is affected by CVE-2025-33120?

IBM QRadar SIEM versions 7.5 through 7.5.0 UP13 are affected by CVE-2025-33120.

What type of vulnerability is CVE-2025-33120?

CVE-2025-33120 is a privilege escalation vulnerability due to a misconfigured cronjob.

Can unprivileged users exploit CVE-2025-33120?

Yes, an authenticated unprivileged user could exploit CVE-2025-33120 to escalate their privileges.

CVE-2025-33120: IBM QRadar SIEM privilege escalation

Other sources

Affected Software

Remediation

Information

Event History

Parent advisories

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-33120?

How do I fix CVE-2025-33120?

Who is affected by CVE-2025-33120?

What type of vulnerability is CVE-2025-33120?

Can unprivileged users exploit CVE-2025-33120?

Company

Resources

Contact