CVE-2025-36042 Overview
IBM QRadar Security Information and Event Manager (SIEM) 7.5 through 7.5.0 contains a stored cross-site scripting (XSS) vulnerability in the Dashboard component. An authenticated user can embed arbitrary JavaScript in the Web UI, altering the intended functionality and potentially exposing credentials within a trusted session. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
IBM issued a security bulletin addressing the issue on its IBM Security Support Page. The vulnerability affects both qradar_security_information_and_event_manager and qradar_incident_forensics products.
Critical Impact
An authenticated attacker can inject JavaScript into the QRadar Dashboard, hijack trusted analyst sessions, and disclose credentials or sensitive SIEM data.
Affected Products
- IBM QRadar Security Information and Event Manager 7.5.0 (base through Update Pack 13)
- IBM QRadar Incident Forensics 7.5.0 (base through Update Pack 13)
- QRadar Dashboard component in the Web UI
Discovery Timeline
- 2025-08-22 - CVE-2025-36042 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36042
Vulnerability Analysis
The vulnerability resides in the QRadar Dashboard, a component analysts use to visualize security events, offense summaries, and asset data. The Dashboard fails to properly neutralize user-supplied input rendered within the Web UI. An authenticated user with permissions to create or modify Dashboard content can store JavaScript payloads that execute when other users view the affected view.
Because the exploit requires an authenticated session, the attack profile is aligned with insider misuse or a compromised low-privileged account. Successful execution occurs in the victim's browser context under the QRadar origin, meaning it can access session tokens, CSRF material, and DOM elements available to that user. The changed scope classification indicates that impact extends beyond the vulnerable component to affect the security posture of the wider Web UI session.
Root Cause
QRadar's Dashboard rendering path does not apply sufficient output encoding or input sanitization before writing user-controlled data into HTML contexts. This omission allows <script> tags or event-handler attributes such as onerror and onload to survive processing and execute during page render.
Attack Vector
An authenticated attacker crafts a Dashboard element containing a JavaScript payload and saves it to the shared configuration. When a QRadar administrator or analyst loads the Dashboard, the payload executes in that user's browser under the trusted QRadar origin. The attacker can then exfiltrate session cookies, issue authenticated API calls, or capture credentials submitted through injected form overlays.
No verified public exploit or proof-of-concept has been published. See the IBM Security Support Page for vendor-specific technical details.
Detection Methods for CVE-2025-36042
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= in saved Dashboard items or widget titles.
- QRadar audit log entries showing Dashboard modifications by non-administrative or service accounts.
- Outbound HTTP requests from analyst browsers to unfamiliar domains immediately after loading the QRadar Web UI.
Detection Strategies
- Review the QRadar AuditLog for Dashboard create, update, and share actions and correlate them with the initiating user identity.
- Inspect stored Dashboard configurations in the database for HTML control characters and script-related tokens.
- Monitor browser Content Security Policy (CSP) violation reports if CSP is configured for the QRadar Web UI.
Monitoring Recommendations
- Alert on privileged-user browser sessions that generate outbound traffic to untrusted destinations after visiting the QRadar console.
- Track anomalous API activity originating from analyst sessions, such as unexpected user or role enumeration.
- Enable and centrally forward QRadar web access logs for correlation with authentication events.
How to Mitigate CVE-2025-36042
Immediate Actions Required
- Apply the QRadar SIEM update referenced in the IBM Security Bulletin as soon as it is available in your maintenance window.
- Audit all existing Dashboards and remove any items containing untrusted HTML or scripts.
- Restrict Dashboard authoring and sharing capabilities to a minimal set of trusted administrators.
Patch Information
IBM has published remediation guidance for QRadar SIEM 7.5.0 on the IBM Security Support Page. Administrators should identify their current Update Pack level and upgrade to the fixed release identified in the bulletin. Both QRadar SIEM and QRadar Incident Forensics deployments should be updated.
Workarounds
- Reduce the number of accounts with permission to create or edit Dashboards until the patch is applied.
- Require analysts to access the QRadar console from hardened, dedicated browsers with restrictive extensions and no saved credentials for other systems.
- Enforce short session timeouts and re-authentication for sensitive administrative actions in QRadar.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
