{"id":"CVE-2026-10025","published":"2026-08-05T16:16:49.197","lastModified":"2026-08-10T19:36:16.843","description":"IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","cwes":["CWE-611"],"vendors":["ibm"],"products":["qradar security information and event manager"],"references":[{"url":"https://www.ibm.com/support/pages/node/7282394","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is an XML External Entity (XXE) injection vulnerability in IBM QRadar, allowing unauthorized access to sensitive information through improperly processed XML-formatted syslog events.","exploitability":"Exploitation is relatively easy if an attacker can send XML-formatted syslog events to the QRadar system on port 514 without authentication. Precondition is that at least one log source type is configured to use XML-format property autodetection.","blast_radius":"If exploited, the vulnerability could lead to the exposure of sensitive information, potentially impacting the security and confidentiality of the system and its data.","remediation":"Disable XML-format property autodetection for all log sources or upgrade to IBM QRadar 7.6.0.2 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xxe","xml","syslog","information-leak"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:58:57.469Z"}}