CVE-2025-13995: IBM QRadar SIEM Information Disclosure

CVE-2025-13995 Overview

IBM QRadar SIEM versions 7.5.0 through 7.5.0 Update Package 14 contain a multi-tenant data isolation vulnerability that could allow an attacker with access to one tenant to access hostname data from another tenant's account. This vulnerability represents a significant breach in the data isolation mechanisms that are fundamental to multi-tenant SIEM deployments.

Critical Impact

Attackers with legitimate access to one tenant environment can potentially view sensitive hostname information belonging to other organizations sharing the same QRadar SIEM infrastructure, compromising tenant confidentiality.

Affected Products

• IBM QRadar SIEM 7.5.0
• IBM QRadar SIEM 7.5.0 Update Package 1 through Update Package 14

Discovery Timeline

• 2026-03-19 - CVE-2025-13995 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-13995

Vulnerability Analysis

This vulnerability is classified under CWE-1286 (Improper Validation of Syntactic Correctness of Input), indicating a failure in properly validating and enforcing tenant boundary controls within the QRadar SIEM platform. The flaw exists in how the system handles hostname data across multi-tenant deployments, where insufficient access control validation allows cross-tenant data leakage.

The vulnerability can be exploited remotely over the network by an authenticated attacker with low privileges. No user interaction is required for exploitation. Critically, the scope is changed, meaning the vulnerability affects resources beyond its security scope—in this case, data belonging to other tenants. While the vulnerability only impacts confidentiality (exposing read-only access to hostname data), the exposure of infrastructure information across tenant boundaries represents a serious breach of multi-tenant isolation guarantees.

Root Cause

The root cause stems from improper validation of tenant context when processing hostname queries or displaying hostname information within the QRadar SIEM interface. The application fails to properly enforce tenant isolation boundaries, allowing data requests from one tenant context to inadvertently retrieve or display hostname information associated with other tenants. This represents a fundamental breakdown in the multi-tenant access control model.

Attack Vector

The attack can be executed over the network by an authenticated user with low-level privileges on the QRadar SIEM platform. The attacker must have legitimate access to at least one tenant within the multi-tenant QRadar deployment. By exploiting the improper validation of tenant boundaries, the attacker can access hostname data belonging to other tenants without requiring elevated privileges or user interaction.

The vulnerability mechanism involves the following exploitation scenario: An authenticated user within their legitimate tenant context can craft or manipulate requests that bypass tenant isolation checks, resulting in the retrieval of hostname information from other tenant accounts. This cross-tenant data exposure could reveal sensitive infrastructure information about other organizations.

For detailed technical information, refer to the IBM Support Page.

Detection Methods for CVE-2025-13995

Indicators of Compromise

• Unusual cross-tenant API queries or database requests targeting hostname tables
• Anomalous access patterns from authenticated users accessing hostname data outside their tenant scope
• Unexpected hostname enumeration activities within QRadar logs
• Audit log entries showing tenant boundary violations or cross-tenant data access attempts

Detection Strategies

• Monitor QRadar audit logs for unusual hostname query patterns that span multiple tenant contexts
• Implement anomaly detection for authenticated users accessing hostname information at unusual frequencies
• Review access control logs for failed or successful cross-tenant access attempts
• Deploy network monitoring to detect unusual API call patterns to QRadar endpoints

Monitoring Recommendations

• Enable verbose logging for all tenant-related access control decisions
• Configure alerts for cross-tenant data access attempts in your SIEM environment
• Regularly audit user access patterns to identify potential exploitation attempts
• Implement real-time monitoring of hostname data access across all tenants

How to Mitigate CVE-2025-13995

Immediate Actions Required

• Review the IBM security advisory and apply the recommended patches immediately
• Audit existing tenant configurations to ensure proper isolation settings are in place
• Review access logs for any signs of cross-tenant data access exploitation
• Limit user privileges to the minimum required for their operational needs

Patch Information

IBM has released a security update addressing this vulnerability. Organizations running IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 should apply the latest security patches as documented in the IBM Support Page. The fix addresses the improper validation that allowed cross-tenant hostname data exposure.

Workarounds

• Implement network segmentation to restrict access to QRadar management interfaces
• Review and strengthen tenant isolation configurations within QRadar
• Apply principle of least privilege for all QRadar user accounts
• Consider temporarily limiting multi-tenant functionality until patches can be applied

# Verify QRadar SIEM version to determine vulnerability status
/opt/qradar/bin/myver -v

# Review current update package level
cat /etc/qradar-version

# Check audit logs for potential cross-tenant access attempts
grep -i "tenant" /var/log/qradar.log | grep -i "hostname"