CVE-2026-105467: IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS

Q: Who is exposed to exploitation?

Authenticated IBM QRadar users who can be persuaded to open a specifically crafted URL are exposed. The issue requires user interaction, but does not require the attacker to already have privileges in QRadar.

Q: Which QRadar releases are affected?

Affected versions are QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and QRadar 7.6.0.0 through 7.6.0.5.

Q: What impact could successful exploitation have?

The supplied severity vector rates confidentiality and integrity impact as high, with no availability impact. The vulnerability is identified as reflected cross-site scripting.

Published Nov 3, 2026

Updated

IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.

Other sources

IBM QRadar SIEM is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.

— IBM

Affected Software

2 affected components

IBM QRadar<=7.5.0 - 7.5.0 UP16 IF02

IBM QRadar<=7.6.0.0 - 7.6.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM QRadar SIEM to a version that resolves this vulnerability.
Fixed in 7.6.0.6
Upgrade
Upgrade IBM QRadar SIEM to a version that resolves this vulnerability.
Fixed in 7.5.0 UP16 IF03

Event History

Nov 3, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·04:49 PM

Data Sourced

via MITRE·04:49 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295450

Frequently Asked Questions

Who is exposed to exploitation?

Authenticated IBM QRadar users who can be persuaded to open a specifically crafted URL are exposed. The issue requires user interaction, but does not require the attacker to already have privileges in QRadar.

Which QRadar releases are affected?

Affected versions are QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and QRadar 7.6.0.0 through 7.6.0.5.

What impact could successful exploitation have?

The supplied severity vector rates confidentiality and integrity impact as high, with no availability impact. The vulnerability is identified as reflected cross-site scripting.

CVE-2026-105467: IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is exposed to exploitation?

Which QRadar releases are affected?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

Which QRadar releases are affected?

What impact could successful exploitation have?