CVE-2023-47726 is an improper input validation flaw in IBM QRadar Suite Software and IBM Cloud Pak for Security. NVD scores it 7.1, High. An authenticated user could execute certain commands through dashboard input. IBM says to upgrade to at least version 1.10.22.0.
What's affected
The NVD record lists QRadar Suite Software and Cloud Pak for Security 1.10.12.0 through 1.10.21.0. IBM's bulletin lists QRadar Suite Software 1.10.12.0 through 1.10.21.0, and also lists IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0. Source conflict on versions: the record gives one range for both products, while the bulletin gives a wider range for Cloud Pak for Security. Follow the bulletin.
IBM's fix is an upgrade to at least version 1.10.22.0, following the Cloud Pak for Security upgrade instructions. IBM lists no workarounds. The bulletin summary says the suite is vulnerable to injection attacks through dashboard input.
The weakness in the record is CWE-1287, improper validation of input of a specified type. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, and IBM's bulletin gives the same 7.1 in CVSS 3.0 form. The bulletin credits the IBM Security Ethical Hacking Team.
How to check if you're exposed
Check the installed version of the suite in the Cloud Pak for Security administration, or through the operator version on the cluster. Compare it with the ranges above, and treat anything below 1.10.22.0 as in scope.
If you run the product on OpenShift, check the version of the installed operator and the suite instance with your usual cluster tooling. I am not giving exact commands, because the resource names depend on how the product was installed.
What to do now
- Upgrade QRadar Suite Software or Cloud Pak for Security to at least 1.10.22.0, following IBM's upgrade documentation.
- Take a backup and plan a maintenance window, as this is a platform upgrade.
- Review who can create or edit dashboards, and limit that right.
- Review the audit records for dashboard changes since you installed an affected version.
- Record the upgrade in your change log for audit purposes.
Why it matters
Improper input validation is a broad label. Here the weakness is that a dashboard field accepted input of a type the application did not check, and certain commands ran as a result. IBM's text says only that an authenticated user could run certain arbitrary commands, and this post does not guess beyond it.
The record gives the weakness as CWE-1287. The practical lesson is that anything a user can type into a dashboard, a query box or a filter is input to the system underneath it. Security tools are not exempt, and the SIEM is a target because it sees so much of your environment.
The confidentiality rating is High in the vector, and integrity is Low. The attacker needs an account. Which accounts can edit dashboards is therefore the question that decides how much this matters to you.
Quick check
Which version fixes it?
IBM says to upgrade to at least 1.10.22.0.
Is there a workaround?
IBM lists none.
Sources
- IBM security bulletin for QRadar Suite
- IBM X-Force entry 272087
- Safeguard Gold page for CVE-2023-47726
Last reviewed: 19 October 2026.
