{"id":"CVE-2026-105467","kind":"vulnerability","aliases":["CVE-2026-105467"],"related":[],"title":"IBM QRadar: reflected cross-site scripting flaw in web console","description":"IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.","summary":"IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5, contain a reflected cross-site scripting flaw. A victim who opens a crafted URL while logged in to QRadar can have attacker-supplied script run in their session.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"qradar-siem","fixed":["7.6.0.6","7.5.0 UP16 IF03"],"affected":"7.5.0 through 7.5.0 UP16 IF02; 7.6.0.0 through 7.6.0.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-qradar","self-hosted","siem","vendor","web-console","xss"],"not_affected_if":["fixed-version","unaffected-version"],"how_to_check":"Check the QRadar version in the console (Admin > System and License Management, or About). Exposed if 7.5.0 through 7.5.0 UP16 IF02, or 7.6.0.0 through 7.6.0.5. Fixed: 7.6.0.6 or 7.5.0 UP16 IF03.","fix":"Upgrade QRadar SIEM 7.6.0.x to 7.6.0.6, or 7.5.0 to 7.5.0 Update Pack 16 Interim Fix 03. IBM lists no workaround.","status":"open","published_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:21:59+00:00","triaged_at":"2026-11-08T17:22:05+00:00","updated_at":"2026-11-08T17:23:20+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-08T17:22:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM QRadar: reflected cross-site scripting flaw in web console","impact":"medium","summary":"IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5, contain a reflected cross-site scripting flaw. A victim who opens a crafted URL while logged in to QRadar can have attacker-supplied script run in their session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-qradar","siem","web-console"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker script runs in an authenticated QRadar user's session","analyst_note":"Find the IBM security bulletin for CVE-2026-105467 to confirm fixed versions and any workaround; the NVD entry alone does not state a fix.","how_to_check":"- Check the installed QRadar version against the affected ranges (7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5).\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"QRadar deployments in the listed version ranges are exposed when a logged-in user opens a crafted link. Exposure depends on users browsing links while authenticated to the console. The sources do not say which fixed versions exist.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4592,"output_tokens":592,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-105467 to confirm fixed versions and any workaround; the NVD entry alone does not state a fix.","search":"'-105467':14A,17A '-2026':13A,16A '02':43B,88C '16':40B,85C '7.5.0':35B,37B,80C,82C '7.6.0.0':45B,90C '7.6.0.5':47B,92C 'attack':71B 'attacker-suppli':70B 'authent':107C 'consol':11A,31B 'contain':48B 'craft':61B,104C 'cross':5A,52B 'cross-sit':4A,51B 'cve':12A,15A 'fix':42B,87C 'flaw':8A,55B 'host':26B 'ibm':1A,22B,33B,78C 'ibm-qradar':21B 'interim':41B,86C 'log':64B 'must':100C 'open':59B,101C 'pack':39B,84C 'qradar':2A,19A,23B,34B,67B,79C,109C 'qradar-siem':18A 'reflect':3A,50B,96C 'run':74B 'script':7A,54B,73B 'self':25B 'self-host':24B 'session':77B 'siem':20A,27B 'site':6A,53B 'specif':103C 'suppli':72B 'trigger':111C 'updat':38B,83C 'url':62B,105C 'vendor':28B 'victim':57B,99C 'vulner':94C 'web':10A,30B 'web-consol':29B 'xss':32B,97C","nicknames":[],"mitigations":[],"who_affected":"Self-managed IBM QRadar SIEM deployments on 7.5.0 through 7.5.0 UP16 IF02 or 7.6.0.0 through 7.6.0.5. An attacker needs a QRadar user to open a crafted URL while logged in to the console, so analysts and admins who click links are the target. Teams on 7.6.0.6 or 7.5.0 UP16 IF03 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T17:23:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295450","run_id":2201},"products":{"at":"2026-11-08T17:23:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295450","run_id":2201},"workarounds":{"at":"2026-11-08T17:23:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295450","run_id":2201},"how_to_check":{"at":"2026-11-08T17:23:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295450","run_id":2201},"who_affected":{"at":"2026-11-08T17:23:20Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295450","run_id":2201}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["qradarsiem"],"ptokens":["qradar","siem"],"labels":["high","ibmqradar","selfhosted","siem","vendor","webconsole","xss"],"campaign_type":null,"search_a":"'-105467':14A,17A '-2026':13A,16A 'consol':11A 'cross':5A 'cross-sit':4A 'cve':12A,15A 'flaw':8A 'ibm':1A 'qradar':2A,19A 'qradar-siem':18A 'reflect':3A 'script':7A 'siem':20A 'site':6A 'web':10A","search_b":"'02':43B '16':40B '7.5.0':35B,37B '7.6.0.0':45B '7.6.0.5':47B 'attack':71B 'attacker-suppli':70B 'consol':31B 'contain':48B 'craft':61B 'cross':52B 'cross-sit':51B 'fix':42B 'flaw':55B 'host':26B 'ibm':22B,33B 'ibm-qradar':21B 'interim':41B 'log':64B 'open':59B 'pack':39B 'qradar':23B,34B,67B 'reflect':50B 'run':74B 'script':54B,73B 'self':25B 'self-host':24B 'session':77B 'siem':27B 'site':53B 'suppli':72B 'updat':38B 'url':62B 'vendor':28B 'victim':57B 'web':30B 'web-consol':29B 'xss':32B","search_c":"'02':88C '16':85C '7.5.0':80C,82C '7.6.0.0':90C '7.6.0.5':92C 'authent':107C 'craft':104C 'fix':87C 'ibm':78C 'interim':86C 'must':100C 'open':101C 'pack':84C 'qradar':79C,109C 'reflect':96C 'specif':103C 'trigger':111C 'updat':83C 'url':105C 'victim':99C 'vulner':94C 'xss':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105467","severity":null,"published_at":"2026-11-08T17:16:35+00:00","modified_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:21:59+00:00","fetched_at":"2026-11-08T17:21:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105467:2201","url":"https://www.ibm.com/support/pages/node/7295450","severity":null,"published_at":"2026-11-08T17:23:20+00:00","modified_at":"2026-11-08T17:23:20+00:00","first_seen_at":"2026-11-08T17:23:20+00:00","fetched_at":"2026-11-08T17:23:20+00:00","note":"Read IBM bulletin node/7295450 (3 Nov 2026): fixes 7.6.0.6 and 7.5.0 UP16 IF03, workarounds none. Bulletin also covers CVE-2026-105473 (open redirect). No exploitation or PoC seen; no social search done (B tier).","cites":["https://www.ibm.com/support/pages/node/7295450"]}],"documents":[{"id":102706,"url":"https://www.ibm.com/support/pages/node/7295450","title":"IBM Security Bulletin: QRadar SIEM Open Redirect and Reflected XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}