CVE-2025-36376
Session Fixation in IBM QRadar EDR Allows User Impersonation
Publication date: 2026-02-17
Last updated on: 2026-02-20
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | security_qradar_edr | From 3.12.0 (inc) to 3.12.24 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in IBM Security QRadar EDR versions 3.12 through 3.12.23 is due to the software not invalidating user sessions after they expire.
This means that even after a session should have ended, it remains active, which could allow an authenticated user to impersonate another user on the system.
This issue is classified as CWE-613: Insufficient Session Expiration.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "Because sessions are not invalidated after expiration, an authenticated user could take over another user's session and impersonate them."}, {'type': 'paragraph', 'content': "This can lead to unauthorized access to sensitive information or actions performed under another user's identity."}, {'type': 'paragraph', 'content': 'The vulnerability impacts confidentiality, integrity, and availability to a low or low-medium degree, as indicated by its CVSS score of 6.3.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade IBM Security QRadar EDR to version 3.12.24, where the issue has been addressed.
The product supports both automatic and manual operator upgrade strategies to manage updates.
No other workarounds or mitigations are provided aside from upgrading.