{"id":"CVE-2026-105473","kind":"vulnerability","aliases":["CVE-2026-105473"],"related":[],"title":"IBM QRadar: open redirect lets crafted links send logged-in users elsewhere","description":"IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Open Redirect. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.","summary":"IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02 and 7.6.0.0 through 7.6.0.5 contain an open redirect flaw. A victim who opens a crafted URL while logged in to QRadar can be sent to a site the attacker chooses.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm","infrastructure","qradar","siem"],"not_affected_if":["no-authenticated-sessions","unaffected-version"],"how_to_check":"- Identify QRadar versions in use and compare against 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02 and 7.6.0.0 through 7.6.0.5\n- Check the installed QRadar version in the console (unknown exact command in sources)","fix":null,"status":"open","published_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:21:59+00:00","triaged_at":"2026-11-08T17:22:09+00:00","updated_at":"2026-11-08T17:22:09+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T17:22:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM QRadar: open redirect lets crafted links send logged-in users elsewhere","impact":"low","summary":"IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02 and 7.6.0.0 through 7.6.0.5 contain an open redirect flaw. A victim who opens a crafted URL while logged in to QRadar can be sent to a site the attacker chooses.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["qradar","siem","ibm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"logged-in users redirected to attacker-chosen phishing site","analyst_note":"","how_to_check":"- Identify QRadar versions in use and compare against 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02 and 7.6.0.0 through 7.6.0.5\n- Check the installed QRadar version in the console (unknown exact command in sources)","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["unaffected-version","no-authenticated-sessions"],"who_is_affected":"Organizations running affected QRadar SIEM versions where analysts are logged in and may open links from outside. Exposure depends on users clicking crafted URLs while authenticated. Systems on unaffected versions can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4591,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105473':16A,19A '-2026':15A,18A '02':34B,75C '16':31B,72C '7.5.0':26B,28B,67C,69C '7.6.0.0':36B,77C '7.6.0.5':38B,79C 'attack':63B 'authent':94C 'choos':64B 'contain':39B 'craft':6A,49B,91C 'cve':14A,17A 'elsewher':13A 'fix':33B,74C 'flaw':43B 'ibm':1A,20B,24B,65C 'infrastructur':21B 'interim':32B,73C 'let':5A 'link':7A 'log':10A,52B 'logged-in':9A 'must':87C 'open':3A,41B,47B,83C,88C 'pack':30B,71C 'qradar':2A,22B,25B,55B,66C,96C 'redirect':4A,42B,84C 'send':8A 'sent':58B 'siem':23B 'site':61B 'specif':90C 'trigger':98C 'updat':29B,70C 'url':50B,92C 'user':12A 'victim':45B,86C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Organizations running affected QRadar SIEM versions where analysts are logged in and may open links from outside. Exposure depends on users clicking crafted URLs while authenticated. Systems on unaffected versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibm","infrastructure","medium","qradar","siem"],"campaign_type":null,"search_a":"'-105473':16A,19A '-2026':15A,18A 'craft':6A 'cve':14A,17A 'elsewher':13A 'ibm':1A 'let':5A 'link':7A 'log':10A 'logged-in':9A 'open':3A 'qradar':2A 'redirect':4A 'send':8A 'user':12A","search_b":"'02':34B '16':31B '7.5.0':26B,28B '7.6.0.0':36B '7.6.0.5':38B 'attack':63B 'choos':64B 'contain':39B 'craft':49B 'fix':33B 'flaw':43B 'ibm':20B,24B 'infrastructur':21B 'interim':32B 'log':52B 'open':41B,47B 'pack':30B 'qradar':22B,25B,55B 'redirect':42B 'sent':58B 'siem':23B 'site':61B 'updat':29B 'url':50B 'victim':45B","search_c":"'02':75C '16':72C '7.5.0':67C,69C '7.6.0.0':77C '7.6.0.5':79C 'authent':94C 'craft':91C 'fix':74C 'ibm':65C 'interim':73C 'must':87C 'open':83C,88C 'pack':71C 'qradar':66C,96C 'redirect':84C 'specif':90C 'trigger':98C 'updat':70C 'url':92C 'victim':86C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105473","severity":null,"published_at":"2026-11-08T17:16:35+00:00","modified_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:21:59+00:00","fetched_at":"2026-11-08T17:21:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}