CVE-2026-13477
Full vulnerability record from the local CVENow database.
Description
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-05 16:16:49.863000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-13477",
"sourceIdentifier": "[email protected]",
"published": "2026-08-05T16:16:49.863",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input."
},
{
"lang": "es",
"value": "IBM QRadar 7.6.0.0 hasta 7.6.0.1, y 7.5.0 hasta 7.5.0 UP 15 Interim Fix 005 podría permitir a un usuario privilegiado autenticado ejecutar comandos arbitrarios con privilegios de usuario normal en el sistema debido a una validación indebida de la entrada suministrada por el usuario."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "IBM",
"product": "QRadar",
"cpes": [
"cpe:2.3:a:ibm:qradar:7.6.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:qradar:7.6.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:qradar:7.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:qradar:7.5.0up15:interim_fix_005:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0.0",
"lessThanOrEqual": "7.6.0.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.5.0",
"lessThanOrEqual": "7.5.0 UP 15 Interim Fix 005",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.2,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-05T00:00:00+00:00",
"id": "CVE-2026-13477",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "DACA17CC-8B71-4E71-B075-BFFB65AD989C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "BA60FDE5-8C40-4C7A-97CF-BA2A64BF307D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "3D6ADD3A-99BC-495F-9835-92D16DF18FC1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "5C899CFD-26F5-43FA-A39E-7196E2929AD9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "0C534E65-D418-4A5E-B326-F449337C0408"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "A3F6494F-EC1B-4963-908A-88190E5BF835"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:*",
"matchCriteriaId": "4779E5F6-6CA5-4EF7-8C0C-DC13362DAE45"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:*",
"matchCriteriaId": "17894E0A-F47C-416F-99E3-26B158B5F852"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "CD7E8A56-06DB-45AC-9769-4B198B142CAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_01:*:*:*:*:*:*",
"matchCriteriaId": "605EA97A-BF41-4B49-8C79-43E62CDD29FD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_02:*:*:*:*:*:*",
"matchCriteriaId": "191CF202-DEC2-4715-A4E1-B0BE1D01BB7D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "A152A7B3-A513-4DB7-B0FE-D8B70A1E6997"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_01:*:*:*:*:*:*",
"matchCriteriaId": "EB2D2628-C4A4-4E1D-BF38-15A06B20604A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_02:*:*:*:*:*:*",
"matchCriteriaId": "5E0D50AB-6C6E-43AB-8580-6F4CF1C43CDE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_03:*:*:*:*:*:*",
"matchCriteriaId": "DC954041-2E89-4D6C-B362-12F876B49908"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_04:*:*:*:*:*:*",
"matchCriteriaId": "FED4CDD2-51AD-42B4-B981-FBE5DB0779FA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "AB518E06-00BA-48F3-8AEC-6E1E97CAA2CC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "289027A2-178C-45DE-A86F-1207F23D13B1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "5047AECF-879B-427A-ACF7-ECB10965E1B0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "CD448AB8-E3CC-41A1-9D32-B1B35C68FA5C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "9F4014E8-42E2-4B76-B2DA-8B50929A4AB5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "BD0A459A-C74A-4E18-83B3-4C29D47D2C2B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "721EFDD7-EE35-430C-AF17-C54BDB10434E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "4C3D4D7E-0B57-47E3-BD16-5BBCE05063F5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "C60B58A3-1F91-4736-85CF-239841BD1769"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "00631255-DEE9-459B-9438-48CB63D60841"
}
]
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7282395",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}