{"id":"CVE-2026-91868","kind":"vulnerability","aliases":["CVE-2026-91868"],"related":[],"title":"IBM QRadar EDR: authenticated attacker can obtain sensitive information","description":"IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.","summary":"IBM Security QRadar EDR versions 3.12 through 3.12.26 have an improper access control flaw. A remote attacker with a valid account can obtain sensitive information they should not see.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edr","ibm","qradar-edr","vendor"],"not_affected_if":["outside-affected-range"],"how_to_check":"- Check the installed QRadar EDR version against the affected range 3.12 through 3.12.26 in the product console or deployment records.","fix":null,"status":"open","published_at":"2026-11-13T22:17:26+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","triaged_at":"2026-11-13T22:34:29+00:00","updated_at":"2026-11-13T22:34:29+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T22:34:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM QRadar EDR: authenticated attacker can obtain sensitive information","impact":"medium","summary":"IBM Security QRadar EDR versions 3.12 through 3.12.26 have an improper access control flaw. A remote attacker with a valid account can obtain sensitive information they should not see.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","qradar-edr","edr"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information they should not access","analyst_note":"Check the IBM security bulletin for CVE-2026-91868 for the fixed version and any setting changes; sources only give the NVD description.","how_to_check":"- Check the installed QRadar EDR version against the affected range 3.12 through 3.12.26 in the product console or deployment records.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-range"],"who_is_affected":"Organizations running IBM Security QRadar EDR in the 3.12 through 3.12.26 range. Exposure requires an authenticated account on the product; sources do not describe other configuration requirements.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4517,"output_tokens":468,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-91868':12A,15A '3.12':27B,55C '3.12.26':29B,57C 'access':33B,71C 'account':42B 'allow':59C 'attack':5A,38B,63C 'authent':4A,62C 'control':34B,72C 'could':58C 'cve':10A,13A 'due':68C 'edr':3A,16B,20B,25B,54C 'flaw':35B 'ibm':1A,17B,22B,51C 'improp':32B,70C 'inform':9A,46B,67C 'obtain':7A,44B,65C 'qradar':2A,19B,24B,53C 'qradar-edr':18B 'remot':37B,61C 'secur':23B,52C 'see':50B 'sensit':8A,45B,66C 'valid':41B 'vendor':21B 'version':26B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Security QRadar EDR in the 3.12 through 3.12.26 range. Exposure requires an authenticated account on the product; sources do not describe other configuration requirements.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["edr","ibm","medium","qradaredr","vendor"],"campaign_type":null,"search_a":"'-2026':11A,14A '-91868':12A,15A 'attack':5A 'authent':4A 'cve':10A,13A 'edr':3A 'ibm':1A 'inform':9A 'obtain':7A 'qradar':2A 'sensit':8A","search_b":"'3.12':27B '3.12.26':29B 'access':33B 'account':42B 'attack':38B 'control':34B 'edr':16B,20B,25B 'flaw':35B 'ibm':17B,22B 'improp':32B 'inform':46B 'obtain':44B 'qradar':19B,24B 'qradar-edr':18B 'remot':37B 'secur':23B 'see':50B 'sensit':45B 'valid':41B 'vendor':21B 'version':26B","search_c":"'3.12':55C '3.12.26':57C 'access':71C 'allow':59C 'attack':63C 'authent':62C 'control':72C 'could':58C 'due':68C 'edr':54C 'ibm':51C 'improp':70C 'inform':67C 'obtain':65C 'qradar':53C 'remot':61C 'secur':52C 'sensit':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91868","severity":null,"published_at":"2026-11-13T22:17:26+00:00","modified_at":"2026-11-13T22:17:26+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","fetched_at":"2026-11-13T22:33:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}