CVE-2026-13477 is a medium severity OS command injection flaw (CVSS 4.7) in IBM QRadar. An authenticated, privileged user can run arbitrary commands with normal user privileges on the host. IBM's bulletin lists 7.6.0.2 for the 7.6.0 line and an update for 7.5.0.
What's affected
- IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP15 IF05, per the record and bulletin.
- Fixes per the bulletin: 7.6.0.2 for the 7.6.0 line, and UP15 IF05 for 7.5.0. The 7.5.0 fix is also the end of the affected range as written, so confirm the exact build with IBM.
- Workaround: none. IBM urges prompt updating.
Severity: the record and IBM agree on 4.7 Medium (vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). The bulletin's date differs slightly from the record (the page I read says August 3, 2026, the record says 5 August).
How to check if you're exposed
Check the QRadar version in the console under system and license management, or on the host.
Then compare with the ranges above and the fixed builds, and verify the interim fix level with IBM's bulletin.
What to do now
- Find your QRadar version on every console and managed host.
- Upgrade to 7.6.0.2, or apply the 7.5.0 fix IBM lists, after confirming the exact build.
- Restrict who holds privileged QRadar roles, since the attack needs one.
- Review audit logs for administrative actions that look unusual.
Why it matters
The record classes this as CWE-78 (OS Command Injection). Input from a privileged user is not validated before it reaches a command. The commands then run as a normal user on the host, not as root, which limits the impact and explains the medium score.
A SIEM sits at the center of security monitoring, so an attacker with a foothold there may be able to reach logs, credentials for integrations, and hosts. A privileged account is needed, so the flaw matters most where many people hold admin roles. The record does not list the CVE as exploited, and it is not in CISA KEV.
Because the flaw needs a privileged account, the best time to fix role sprawl is now. Export the list of QRadar users with administrative or privileged roles, ask each owner whether they still need it, and remove the rest. That reduces the risk from this CVE and the next one.
Quick check
Does the command run as root?
No. The record says normal user privileges on the system.
Is there a workaround?
IBM lists none.
Sources
Last reviewed: 18 October 2026.
