{"id":"CVE-2026-93441","kind":"vulnerability","aliases":["CVE-2026-93441"],"related":[],"title":"IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service","description":"IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","summary":"The QRadar SIEM HTTP Receiver protocol has an uncontrolled resource consumption flaw (CWE-400). A remote attacker needs no authentication, privileges or user interaction. Sending crafted requests can exhaust resources and take the SIEM offline. IBM rates it CVSS 8.6. IBM lists no workaround. Only deployments that use the HTTP Receiver log source protocol are affected.","severity":"high","cvss":8.6,"epss":0.00327,"exploited":false,"exploited_at":null,"products":[{"name":"IBM QRadar SIEM HTTP Receiver protocol","fixed":["7.5-20260930064859","7.6-20260930064911"],"affected":">= 7.4-20210823144546, <= 7.5-20260930064858; >= 7.6-20260330053257, <= 7.6-20260930064910","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["http-receiver","ibm-qradar","infrastructure","self-hosted","siem"],"not_affected_if":["no-http-receiver-log-source"],"how_to_check":"In QRadar, check whether any log source uses the HTTP Receiver protocol (Admin > Log Sources). Then check the installed HTTP Receiver protocol RPM build: affected builds are 7.4-20210823144546 to 7.5-20260930064858, and 7.6-20260330053257 to 7.6-20260930064910. On the console, running rpm -qa | grep -i PROTOCOL-HTTPReceiver should show the build.","fix":"Install PROTOCOL-HTTPReceiver-7.5-20260930064859.noarch.rpm on 7.5, or PROTOCOL-HTTPReceiver-7.6-20260930064911.noarch.rpm on 7.6. QRadar Auto Update delivers these RPMs where it is enabled. IBM lists no workarounds. For 7.4, IBM names no separate fix, so check the bulletin.","status":"open","published_at":"2026-10-20T22:21:07+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:39:25+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of service","impact":"low","summary":"IBM QRadar SIEM has an uncontrolled resource consumption flaw that a remote attacker can trigger. The result is a denial of service, taking the SIEM offline.","category":"infrastructure","who_cares":["ibm-qradar","siem"],"confidence":0.5,"needs_auth":"unknown","worst_case":"SIEM service becomes unavailable to the defenders relying on it","analyst_note":"Find the affected QRadar versions and IBM's advisory for CVE-2026-93441 to confirm the fixed release and whether authentication is needed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000447,"input_tokens":2856,"output_tokens":322,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected QRadar versions and IBM's advisory for CVE-2026-93441 to confirm the fixed release and whether authentication is needed.","search":"'-2026':15A,18A '-400':50B '-93441':16A,19A '8.6':76B 'affect':92B 'allow':97C 'attack':5A,53B,100C 'authent':56B 'caus':10A,102C 'consumpt':47B,111C 'could':96C 'craft':62B 'cve':14A,17A 'cvss':75B 'cwe':49B 'denial':11A,104C 'deploy':82B 'due':107C 'exhaust':7A,65B 'flaw':48B 'host':35B 'http':23A,27B,40B,86B 'http-receiv':26B 'ibm':1A,20A,30B,72B,77B,93C 'ibm-qradar':29B 'infrastructur':32B 'interact':60B 'list':78B 'log':88B 'need':54B 'offlin':71B 'privileg':57B 'protocol':25A,42B,90B 'qradar':2A,21A,31B,38B,94C 'rate':73B 'receiv':28B,41B,87B 'receiver':24A 'remot':4A,52B,99C 'request':63B 'resourc':8A,46B,66B,110C 'self':34B 'self-host':33B 'send':61B 'servic':13A,106C 'siem':3A,22A,36B,39B,70B,95C 'sourc':89B 'take':68B 'uncontrol':45B,109C 'use':84B 'user':59B 'workaround':80B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93441","severity":null,"published_at":"2026-10-20T22:21:07+00:00","modified_at":"2026-10-21T14:27:54+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93441:530","url":null,"severity":null,"published_at":"2026-10-23T23:51:02+00:00","modified_at":"2026-10-23T23:51:02+00:00","first_seen_at":"2026-10-23T23:51:02+00:00","fetched_at":"2026-10-23T23:51:02+00:00","note":"IBM bulletin (13 Oct 2026) read: flaw is in the QRadar HTTP Receiver protocol; fixed by protocol RPMs. Unauthenticated per IBM CVSS PR:N (Armis says the same). No exploitation or PoC found. I did not search X or social posts. The bulletin title also mentions SQL injection and code execution, but the CVE details cover DoS only."},{"source":"epss","external_id":"CVE-2026-93441","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93441","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":2199,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-qradar-siem-http-receiver-protocol-vulnerable-denial-service-sql-injection-and-could-allow-remote-attacker-execute-arbitrary-code-system","title":"IBM Security Bulletin: QRadar SIEM HTTP Receiver (CVE-2026-93441)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2200,"url":"https://cve.armis.com/CVE-2026-93441","title":"Armis CVE-2026-93441","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}