CVE-2023-50949 is a medium severity (CVSS 5.9) improper certificate validation flaw in IBM QRadar SIEM 7.5 through 7.5.0 UP8. IBM's fix is the QRadar Protocol RabbitMQ package for 7.5.0, available from IBM Fix Central and through Auto Update. Install it on every affected console and managed host.
What's affected
IBM's bulletin lists IBM QRadar SIEM 7.5 through 7.5.0 Update Package 8 as affected. The NVD record names 7.5.0 and its first two update packs among the configurations, and describes the issue as an unauthorized user being able to take actions because of improper certificate validation.
IBM's bulletin explains that the RabbitMQ protocol used by the SOAR integration lacks certificate validation, which could enable man-in-the-middle attacks. The fix is delivered as the 7.5.0 QRadar Protocol RabbitMQ package, dated March 2024 in its file name. IBM states that the updates are also available through Auto Update.
The record and the bulletin differ slightly in how they list affected builds. The NVD record enumerates update packs 1 and 2, while IBM's text says 7.5.0 UP8. Use IBM's range as the guide.
CVSS for this entry is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
How to check if you're exposed
In the QRadar console you can view the installed version and update packs from the admin settings. Compare that with the affected range, then check whether the RabbitMQ protocol package from Fix Central is already installed.
If you use the SOAR integration, treat that connection as the part of your deployment most worth reviewing, since the bulletin ties the flaw to that integration path.
What to do now
- Record the QRadar version and update pack on every console and managed host.
- Download the 7.5.0 QRadar Protocol RabbitMQ package from IBM Fix Central, or let Auto Update deliver it.
- Install it following IBM's bulletin and confirm the package shows as installed.
- Review which hosts the SOAR integration talks to and make sure traffic between them travels only over networks you control.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-295 is improper certificate validation. When a client does not check that the certificate it is shown is the one it expects, a party on the network path can pose as the server. The usual fix is to make the client verify the certificate chain and the host name before it sends or accepts anything.
Certificate validation is what tells a client it is talking to the real server. When it is missing, a party positioned on the network path can pose as the endpoint. The NVD vector reflects that: network attack vector, high attack complexity because the attacker must sit in the path, and an integrity impact only.
A SIEM sits at the center of security monitoring, so even a medium rated flaw in how it exchanges messages deserves a prompt patch window.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Does this affect all of QRadar?
IBM's bulletin scopes it to QRadar SIEM 7.5 through 7.5.0 UP8 and ties it to the RabbitMQ protocol used by the SOAR integration.
How do I get the fix?
From IBM Fix Central as the 7.5.0 QRadar Protocol RabbitMQ package, or through Auto Update, per IBM's bulletin.
Sources
Last reviewed: 19 October 2026.
