CVE-2025-13995: 
IBM QRadar SIEM vulnerability analysis and mitigation

CVE-2025-13995 is a tenant isolation vulnerability in IBM QRadar SIEM that allows an authenticated attacker with access to one tenant to access hostname data belonging to another tenant's account. It affects IBM QRadar SIEM versions 7.5.0 through 7.5.0 Update Package 14. The vulnerability was published on March 19, 2026, with a patch made available shortly after. It carries a CVSS v3.1 base score of 5.0 (Medium) (IBM Advisory, Feedly).

The root cause is classified as CWE-1286 (Improper Validation of Syntactic Correctness of Input), which enables a multi-tenant isolation bypass in QRadar's SIEM platform. An authenticated attacker with valid credentials to one tenant can send crafted network requests that improperly expose hostname data scoped to a different tenant's account. The attack vector is network-based, requires low privileges (valid tenant credentials), no user interaction, and has a changed scope — meaning the impact crosses tenant boundaries. No public proof-of-concept or detailed technical write-up has been identified (IBM Advisory, Feedly).

Successful exploitation allows an attacker to access hostname data from other tenants sharing the same QRadar SIEM deployment, breaching multi-tenant isolation. This exposes infrastructure details of other organizations, which can be leveraged for reconnaissance — mapping out hostnames and potentially identifying targets for further attacks. There is no integrity or availability impact; the risk is limited to confidentiality of hostname information across tenant boundaries (IBM Advisory, Feedly).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, IBM Advisory).

IBM has released a patch addressing this vulnerability; organizations running IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 should apply the available security update immediately by referencing the IBM support page. As interim measures, administrators should implement strict access controls to limit tenant account creation, audit which users have access to multiple tenant accounts, and monitor for suspicious cross-tenant access patterns. Where feasible, segmenting QRadar deployments to isolate different organizational tenants can reduce the blast radius of similar vulnerabilities (IBM Advisory).