Advisory · CVE-2026-105467
IBM QRadar reflected XSS can hijack an authenticated analyst's session
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to reflected cross-site scripting, where a victim must open a specifically crafted URL while authenticated to QRadar to trigger it, rated high at CVSS 8.1.
- Vendor
- IBM
- Product
- QRadar
- Identifier / CWE
- CVE-2026-105467
CWE-79 - Action timing
- Immediate
Explain it like I’m five
QRadar is the security console where analysts watch for attacks. A reflected cross-site scripting flaw lets an attacker send an analyst a booby-trapped link, and opening it while logged in runs the attacker's script inside their QRadar session.
- 01Crafted URL sent
An attacker sends a specifically crafted URL to a QRadar user.
- 02Victim opens link
The authenticated user opens the URL.
- 03Script reflected
The script executes in the victim's browser within the QRadar session.
- 04Session abused
The script acts with the analyst's privileges.
What happened
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this. The record rates it high at CVSS 8.1 under version 3.1, with network attack vector, low complexity, no privileges required, and user interaction required.
IBM’s bulletin lists the affected versions and the fix. A scripted analyst session in a SIEM can pivot into the security tooling itself.
What to do
- Inventory QRadar deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Warn QRadar users not to open untrusted links while authenticated.
- Review QRadar logs for reflected XSS attempts.
- Verify the deployed version after updating.
Management note
A cross-site scripting flaw in the SIEM is a foothold into the security console. Warn the analysts and patch.