CVE-2026-10025: 
IBM QRadar SIEM vulnerability analysis and mitigation

CVE-2026-10025 is an XML External Entity (XXE) injection vulnerability in IBM QRadar Security Information and Event Manager (SIEM). It affects IBM QRadar versions 7.6.0.0 through 7.6.0.1 and 7.5.0 through 7.5.0 UP 15 Interim Fix 005. The vulnerability was published on August 5, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD scoring, and 8.2 (High) per the GitHub Advisory Database (GitHub Advisory, IBM Support).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference) and resides in the parseXmlPayload() function within QRadar's event processing pipeline, specifically inside the q1labs_core.jar component. When at least one log source type is configured to use XML-format property autodetection, the system accepts and parses XML-formatted syslog events arriving on port 514 (UDP/TCP) without requiring authentication. An attacker can craft a malicious XML payload containing external entity references (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd">), which the vulnerable parser resolves, enabling file disclosure or service disruption. No authentication or user interaction is required, and the attack can be launched remotely over the network (GitHub Advisory, IBM Support).

Successful exploitation allows an unauthenticated remote attacker to read sensitive files from the QRadar system (e.g., configuration files, credentials, or OS-level files), potentially exposing confidential security event data and system secrets. The vulnerability also carries a risk of partial service disruption (availability impact). Because QRadar is a SIEM platform that aggregates logs and security events across an organization's infrastructure, file disclosure from this system could expose credentials or configurations enabling lateral movement into other enterprise systems (GitHub Advisory, IBM Support).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies the vulnerability as "automatable," meaning exploitation could be scripted at scale. The EPSS score is approximately 0.32–0.35%, placing it in the 28th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible IBM QRadar instances running versions 7.5.0 through 7.5.0 UP 15 Interim Fix 005 or 7.6.0.0 through 7.6.0.1 using network scanning tools (e.g., Shodan, Censys, or Nmap targeting port 514).
2. Verify precondition: Confirm that at least one log source type on the target QRadar instance is configured to use XML-format property autodetection — this enables the vulnerable XML parsing path.
3. Craft malicious XML payload: Construct a syslog message containing a malicious XML document with an external entity definition, for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<event>&xxe;</event>

4. Send payload to port 514: Transmit the crafted XML-formatted syslog event to the QRadar system on port 514 via UDP or TCP without any authentication credentials.
5. Retrieve disclosed data: The parseXmlPayload() function in q1labs_core.jar resolves the external entity, embedding the contents of the targeted file into the parsed output, which may be reflected in QRadar logs, error messages, or event data accessible to the attacker.
6. Escalate: Use disclosed file contents (e.g., credentials, SSH keys, configuration files) to pivot to other systems or escalate privileges within the environment (GitHub Advisory, IBM Support).

• Network: Unexpected or anomalous XML-formatted syslog messages arriving on port 514 (UDP/TCP) from untrusted or external IP addresses; syslog traffic containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords indicative of XXE payloads.
• Logs: QRadar event processing logs (related to q1labs_core.jar) showing XML parsing errors or unusual entity resolution attempts; log entries referencing local file paths (e.g., /etc/passwd, /etc/shadow) within parsed XML content.
• Process/Application: Unexpected file read operations by the QRadar Java process targeting sensitive OS files or configuration directories; anomalous outbound DNS or HTTP requests from the QRadar host triggered by external entity resolution (for out-of-band XXE variants).
• File System: Evidence of file access to sensitive paths (e.g., /etc/passwd, /opt/qradar/conf/) in OS-level audit logs (auditd) correlated with syslog ingestion activity.

IBM has released patches addressing this vulnerability; users should update IBM QRadar to a version beyond 7.5.0 UP 15 Interim Fix 005 (for the 7.5.x branch) or beyond 7.6.0.1 (for the 7.6.x branch) (IBM Support). As interim workarounds: restrict network access to port 514 (UDP/TCP) to only trusted and known log source IP addresses using firewall rules; disable XML-format property autodetection on log source types if it is not operationally required. Additionally, monitor syslog traffic for suspicious XML payloads containing entity definitions as a detection measure.