IBM QRadar SIEM Vulnerability Allows Remote Command Execution

IBM has issued a critical security bulletin revealing multiple high-severity vulnerabilities in its QRadar SIEM platform.

These flaws, present in versions 7.5 through 7.5.0 Update Package 12, could allow attackers to execute arbitrary commands, access sensitive data, or compromise system integrity.

The most severe vulnerability (CVE-2025-33117) carries a CVSS score of 9.1, enabling authenticated attackers to upload malicious files and execute commands across the network.

Vulnerability Details

The three critical vulnerabilities include:

The XXE vulnerability (CVE-2025-33121) allows authenticated attackers to process malicious XML data, potentially exposing system information or causing resource exhaustion.

The arbitrary command execution flaw (CVE-2025-33117) enables privileged users to manipulate configuration files and upload malicious updates.

Affected Products and Remediation

All deployments running QRadar SIEM versions 7.5 through 7.5.0 UP12 IF01 are vulnerable.

IBM has released QRadar 7.5.0 UP12 Interim Fix 02 (SFS 20250610184357) to address these issues.

Administrators must:

1. Verify deployment versions using the QRadar console
2. Backup all data before upgrading
3. Install the SFS update file across all appliances
4. Ensure no pending configuration changes exist pre-update

IBM confirms no viable workarounds exist, making immediate patching essential.

The update also resolves additional component vulnerabilities in bundled libraries, including Apache Tomcat and FreeType.

Security teams should monitor authentication logs for suspicious privileged account activity until updates are fully deployed.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates

The post IBM QRadar SIEM Vulnerability Allows Remote Command Execution appeared first on Cyber Security News.