Reflected Cross-Site Scripting in IBM QRadar

Executive Summary

CVE-2026-105467 is a Reflected Cross-Site Scripting (XSS) vulnerability in IBM QRadar SIEM versions 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02 and 7.6.0.0 through 7.6.0.5. It allows an attacker to inject malicious scripts into a victim's browser by tricking them into opening a specially crafted URL while authenticated to QRadar.

Useful 0 Not Useful 0

Detection Guidance

Detecting this Reflected XSS vulnerability requires checking for vulnerable QRadar versions and monitoring for crafted URLs. Inspect QRadar logs for unusual URL patterns or script execution attempts. Use network traffic analysis tools like Wireshark to capture and inspect HTTP requests for suspicious query parameters. Check if your QRadar version is 7.5.0 through 7.5.0 UP16 IF02 or 7.6.0.0 through 7.6.0.5.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to execute malicious scripts in your browser, potentially stealing session cookies, sensitive data, or performing actions on your behalf within QRadar. Since it requires authentication, attackers would need to trick authenticated users into clicking a malicious link.

Useful 0 Not Useful 0

Compliance Impact

A successful exploit could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. This may result in regulatory penalties, reputational damage, and loss of customer trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update QRadar to a patched version: QRadar SIEM 7.6.0.6 or QRadar SIEM 7.5.0 UP16 IF03. IBM strongly recommends prompt updates as no workarounds are available. Monitor IBM's security advisories for further updates.

Useful 0 Not Useful 0