High severity · published Aug 5, 2026
CVE-2026-13477
IBM QRadar SIEM is vulnerable to remote code execution by privileged users
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QR
QRadar · IBM
7.6.0.0 through 7.6.0.1; 7.5.0 through 7.5.0 UP 15 Interim Fix 005 · source: vendor
QS
Qradar Security Information And Event Manager · Ibm
7.5.0; 7.5.0; 7.5.0; 7.5.0; 7.5.0; 7.5.0; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13477
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13477
Vendor Advisory
https://www.ibm.com/support/pages/node/7282395
More from QRadar
9.8
CVE-2026-10025
IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
8.8
CVE-2024-56462
IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
6.7
CVE-2026-5522
QRadar contains hard-coded credentials
6.5
CVE-2025-33141
IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.