How do I check whether I am affected by CVE-2026-93441?

In QRadar, check whether any log source uses the HTTP Receiver protocol (Admin > Log Sources). Then check the installed HTTP Receiver protocol RPM build: affected builds are 7.4-20210823144546 to 7.5-20260930064858, and 7.6-20260330053257 to 7.6-20260930064910. On the console, running rpm -qa | grep -i PROTOCOL-HTTPReceiver should show the build.

What is the fix for CVE-2026-93441?

Install PROTOCOL-HTTPReceiver-7.5-20260930064859.noarch.rpm on 7.5, or PROTOCOL-HTTPReceiver-7.6-20260930064911.noarch.rpm on 7.6. QRadar Auto Update delivers these RPMs where it is enabled. IBM lists no workarounds. For 7.4, IBM names no separate fix, so check the bulletin.

Who is not affected by CVE-2026-93441?

Not affected if: no-http-receiver-log-source.

Live › vulnerability › CVE-2026-93441

Go to dashboard

high8.6Infrastructure

IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service

The QRadar SIEM HTTP Receiver protocol has an uncontrolled resource consumption flaw (CWE-400). A remote attacker needs no authentication, privileges or user interaction. Sending crafted requests can exhaust resources and take the SIEM offline. IBM rates it CVSS 8.6. IBM lists no workaround. Only deployments that use the HTTP Receiver log source protocol are affected.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.6

high

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: SIEM service becomes unavailable to the defenders relying on it.
CVSS said: 8.6. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-93441

Go to dashboard

high8.6Infrastructure

IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.6

high

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: SIEM service becomes unavailable to the defenders relying on it.
CVSS said: 8.6. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources