8.8

CVE-2026-13477

IBM QRadar SIEM is vulnerable to remote code execution by privileged users

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_1
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_10
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_11
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_12
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_13
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_13_interim_fix_01
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_13_interim_fix_02
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_14
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_14_interim_fix_01
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_14_interim_fix_02
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_15
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_15_interim_fix_01
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_15_interim_fix_02
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_15_interim_fix_03
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_15_interim_fix_04
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_2
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_3
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_4
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_5
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_6
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_7
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_8
Ibm ≫ Qradar Security Information And Event Manager Version7.5.0 Updateupdate_pack_9
Ibm ≫ Qradar Security Information And Event Manager Version7.6.0 Updatefix_pack_1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.176
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
IBM 4.7 1.2 3.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.ibm.com/support/pages/node/7282395
Vendor Advisory