CVE-2026-5522
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
IBM QRadar versions 7.5.0 through 7.5.0 UP15 Interim Fix 005 contain hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Hard-coded credentials can be discovered and exploited by an attacker.
Risk Assessment
The risk includes potential unauthorized access to the system or data, as well as compromise of communication integrity if credentials are exposed.
Recommendation
It is recommended to immediately change all hard-coded credentials to unique, secure values and implement secret management mechanisms.
Other vulnerabilities in IBM QRadar
See all- CVE-2016-9740High
IBM QRadar version 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested.
- CVE-2016-9728High
IBM Qradar version 7.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view information in the back-end database.
- CVE-2016-9727High
IBM QRadar version 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands.
- CVE-2016-9724High
IBM QRadar version 7.2 is vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or exhaust available memory resources.
- CVE-2016-2880High
IBM QRadar 7.2 stores the encryption key used to encrypt the service account password, which can be obtained by a local user.
- CVE-2016-2879High
IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credentials.
- CVE-2025-33141Medium
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.
- CVE-2026-13477Medium
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.
- CVE-2026-10025High
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability in the parseXmlPayload() function within the event processing pipeline. When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 without authentication.
Original NVD description (English source)
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS