CVE-2026-10025 is an XML external entity injection flaw in IBM QRadar SIEM, in the event processing pipeline. NVD scores it 8.2, high severity. IBM says the fix is QRadar 7.6.0.2, or the 7.5.0 UP15 IF05 Hotfix 20260715231428, and notes that only some configurations are at risk.
What's affected
IBM's security bulletin lists:
- Affected: QRadar 7.6.0.0 through 7.6.0.1, and QRadar 7.5.0 through 7.5.0 UP15 IF05.
- Fixed: QRadar SIEM 7.6.0.2 on the 7.6.0 line, and 7.5.0 UP15 IF05 Hotfix 20260715231428 on the 7.5.0 line.
- Workarounds and mitigations: none listed.
- Severity: IBM scores it CVSS 8.2, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. The bulletin was first published on 3 August 2026. - Exploitation: the bulletin does not report exploitation, and the CVE is not on the CISA KEV list.
IBM stresses that the flaw is not exploitable in every configuration. All four of these conditions must hold at once:
- XML Property Autodetection is enabled on at least one log source type. IBM calls this a non-default, manually configured setting that is not widely used.
- The event is sent to the log source type that has it enabled.
- The autodetection window is still open. The feature switches itself off after a threshold number of events or properties, and on busy systems that window is likely to be brief.
- An attacker can deliver a crafted event to the syslog intake, which requires network access to the relevant port.
How to check if you're exposed
Check the QRadar version on the console.
/opt/qradar/bin/myver -v
Compare it with the affected ranges above. If you are on 7.6.0.2 or later, or on 7.5.0 UP15 with the named hotfix, you have the fix.
If you are in range, work through IBM's four conditions in order, because each one you can rule out lowers the risk:
- In the QRadar log source type management area, look for log source types where XML property autodetection is enabled. If none are, condition one is not met.
- Look at whether events are being sent to those types, and whether the autodetection window is still open. IBM says the feature disables itself after a threshold, so a type that has been processing events for some time may already be closed.
- Check who can send syslog to the console on port 514, over UDP or TCP. The bulletin describes unauthenticated syslog intake as the entry point. Firewall rules and network segments show who that is.
Do not treat ruling out one condition as a reason to skip the update. Configurations change, and it is simpler to patch than to keep proving a negative.
What to do now
- Confirm the QRadar version and decide which fix applies: 7.6.0.2, or the 7.5.0 UP15 IF05 hotfix named by IBM.
- Schedule the update and apply it following the IBM instructions for your deployment type.
- Until the fix is in, restrict who can send syslog to port 514 on the console and event processors. Allow only known log sources.
- Disable XML property autodetection on any log source type that does not need it.
- Review what has arrived on the syslog intake recently, and watch for XML formatted events from sources you do not know.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity reference. XML allows a document to declare entities, which are placeholders that the parser fills in. If the parser also lets those entities point to outside resources such as local files or network addresses, then a crafted document can make the server read or fetch things it should not. The function IBM names, parseXmlPayload in the event processing pipeline, is where the XML handling lives.
The CVSS vector rates confidentiality impact as high, integrity as none and availability as low. That matches the usual XXE pattern: reading data is the main outcome, and resource exhaustion is a smaller one.
What stands out is the setting around it. A SIEM exists to accept events from many sources, and syslog on port 514 is among the most open doors it has. IBM's bulletin is careful to say that four conditions must hold, and the one most likely to be missing is the transient autodetection window. That is good news for many sites, but it also makes the risk hard to see from outside, so the safest course is to patch.
Security tools are targets because of what they hold: logs, credentials, and a view of the whole network. Keep them on the same patch schedule as the systems they watch.
Try it yourself
When a patch applies only to some configurations, you need to know which of your systems meet the conditions. This demo shows how a vulnerability management view tracks findings, fixes and exceptions in one place.
Click through it at your own pace, or open it full screen.
Quick check
Am I at risk if I never enabled XML property autodetection?
IBM says XML Property Autodetection must be actively enabled on at least one log source type for the system to be at risk, and that it is a non-default setting. Even so, IBM recommends updating.
Which QRadar version fixes it?
QRadar SIEM 7.6.0.2 on the 7.6.0 line, and 7.5.0 UP15 IF05 Hotfix 20260715231428 on the 7.5.0 line.
Sources
Last reviewed: 19 October 2026.
