Critical severity · published Aug 5, 2026
CVE-2026-10025
IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QR
QRadar · IBM
7.6.0.0 through 7.6.0.1; 7.5.0 through 7.5.0 UP 15 Interim Fix 005 · source: vendor
QS
Qradar Security Information And Event Manager · Ibm
7.5.0; 7.5.0; 7.5.0; 7.5.0; 7.5.0; 7.5.0; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10025
Vendor Advisory
https://www.ibm.com/support/pages/node/7282394
More from QRadar
8.8
CVE-2026-13477
IBM QRadar SIEM is vulnerable to remote code execution by privileged users
8.8
CVE-2024-56462
IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
6.7
CVE-2026-5522
QRadar contains hard-coded credentials
6.5
CVE-2025-33141
IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.