high
advisory
IBM QRadar: Reflected Cross-Site Scripting (CVE-2026-105467)
IBM QRadar versions 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 are vulnerable to Reflected XSS. Triggering the vulnerability requires an authenticated user to open a specifically crafted URL.
CVE search metadata
CVE search record: CVE-2026-105467. Severity: high. CVSS: 8.1. KEV: no. Product: QRadar (7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, 7.6.0.0 through 7.6.0.5). Brief: IBM QRadar: Reflected Cross-Site Scripting (CVE-2026-105467). Brief link: https://feed.craftedsignal.io/briefs/2026-11-qradar-xss/
Triage facts
Revision 1- Applicability
- QRadar (7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, 7.6.0.0 through 7.6.0.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 19:34 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 are vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.