XXE Injection Vulnerability in IBM QRadar

IBM QRadar versions 7.6.0.0 through 7.6.0.1 and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 are susceptible to an XML External Entity (XXE) injection vulnerability. The flaw exists within the parseXmlPayload() function located in the q1labs_core.jar component of the event processing pipeline. This vulnerability is reachable when the QRadar system has at least one log source type configured to utilize XML-format property autodetection. An unauthenticated attacker can trigger this vulnerability by transmitting specially crafted XML-formatted syslog events to the standard syslog ingestion ports (UDP/TCP 514). Exploitation of this vulnerability allows for unauthorized access to local files on the system, potentially exposing sensitive configuration data or credentials stored within the QRadar environment.

Impact

Successful exploitation of this XXE vulnerability results in unauthorized disclosure of information (Confidentiality impact) and potentially impacts system availability (Availability impact) by disrupting the event processing pipeline. Organizations running affected versions of IBM QRadar and leveraging XML-based syslog ingestion are at risk of local file disclosure. Given the centralized nature of QRadar as a SIEM, the exposure of files could lead to a broader compromise of the monitored environment.

Recommendation

• Identify all QRadar instances running versions 7.6.0.0-7.6.0.1 or 7.5.0 (up to UP 15 Interim Fix 005).
• Apply the vendor-provided security patches from IBM for CVE-2026-10025 immediately.
• Review log source configurations to disable XML-format property autodetection if it is not strictly required for business operations.
• Monitor network traffic for unusual or highly anomalous XML-formatted syslog patterns directed at port 514 from untrusted segments.