CVE-2026-91869: IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts

Published Nov 13, 2026

Updated

IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.27

Event History

Nov 13, 2026

CVE Published

via MITRE·10:07 PM

Data Sourced

via MITRE·10:07 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must already be authenticated to IBM Security QRadar EDR. The provided data does not indicate that unauthenticated attackers can exploit it.

Which deployments are affected?

IBM Security QRadar EDR versions 3.12 through 3.12.26 are identified as affected. The data does not state whether TOTP verification is enabled by default or which configurations use it.

What security control is bypassed?

The issue involves insufficient rate limiting for TOTP verification attempts, which could let an authenticated attacker bypass security restrictions through excessive authentication attempts.

CVE-2026-91869: IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What security control is bypassed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What security control is bypassed?