---
id: CVE-2026-13477
title: IBM QRadar SIEM is vulnerable to remote code execution by privileged users
summary: >-
  IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix
  005 could allow an authenticated privileged user to execute arbitrary commands
  with normal user privileges on the system due to improper validation of user
  sup…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-78
vendor: IBM
product: QRadar
affected:
  - QRadar >= 7.6.0.0 <= 7.6.0.1
  - QRadar >= 7.5.0 <= 7.5.0 UP 15 Interim Fix 005
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-06T03:55:33.133618Z'
published: '2026-08-05'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T00:17:51.048Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-13477'
references:
  - url: 'https://www.ibm.com/support/pages/node/7282395'
tags:
  - cve.org
epss: 0.00492
epssPercentile: 0.42474
ingestedAt: '2026-11-05T20:33:06.652Z'
---

## Overview

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.

## Affected

- `QRadar >= 7.6.0.0 <= 7.6.0.1`
- `QRadar >= 7.5.0 <= 7.5.0 UP 15 Interim Fix 005`

## Remediation

IBM strongly encourages customers to update their systems promptly.

ProductVersionFixIBM QRadar SIEM 7.5.0  7.5.0 UP15 IF05 https://www.ibm.com/support/pages/release-qradar-750-update-package-15-interim-fix-05-sfs-202161520260715231428 IBM QRadar SIEM 7.6.0  7.6.0.2 https://www.ibm.com/support/pages/node/7280199