CVE-2025-36050: IBM QRadar SIEM Information Disclosure Flaw

CVE-2025-36050 Overview

CVE-2025-36050 affects IBM QRadar Security Information and Event Manager (SIEM) versions 7.5 through 7.5.0 Update Package 12. The product writes potentially sensitive information into log files that can be read by a local user. The weakness maps to [CWE-532: Insertion of Sensitive Information into Log File].

The issue requires local access to the QRadar appliance. An authenticated local user with read access to affected log paths can retrieve confidential data intended for privileged consumers only. Exploitation does not affect integrity or availability, but it does expose data confidentiality.

Critical Impact
A local user on an affected IBM QRadar SIEM appliance can read sensitive information from log files, undermining confidentiality of data processed by the SIEM.

Affected Products

IBM QRadar SIEM 7.5.0 (base release)
IBM QRadar SIEM 7.5.0 Update Packages 1 through 12
Linux kernel (as bundled component in the affected appliance stack)

Discovery Timeline

2025-06-19 - CVE-2025-36050 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36050

Vulnerability Analysis

CVE-2025-36050 is an information disclosure vulnerability classified under [CWE-532]. IBM QRadar SIEM writes sensitive information to log files as part of normal application logging. The affected log files reside on the local filesystem of the QRadar host and are accessible to local users with sufficient filesystem access.

Because QRadar is a SIEM, its logs can contain security-relevant material such as authentication artifacts, configuration values, event payloads, or diagnostic output describing monitored systems. Exposure of this data to any local user violates the confidentiality expectations for a centralized security monitoring platform.

The attack requires no user interaction and no privileges beyond a local account on the appliance. It does not modify data or disrupt service. The impact is limited to confidentiality of information already stored in log files at the time of access.

Root Cause

The root cause is improper handling of sensitive information during logging. Application code writes data that should be redacted, tokenized, or restricted to protected paths into log files whose permissions permit read access by non-privileged local users. See the IBM Security Patch Note for vendor-supplied fix details.

Attack Vector

Exploitation requires local access to the QRadar appliance. A user with shell access, a compromised low-privilege service account, or a chained vulnerability that grants local read primitives can enumerate and read the affected log files. The vulnerability manifests through standard filesystem read operations on the log paths written by QRadar; no exploit code is required.

At time of publication, no public proof-of-concept, ExploitDB entry, or CISA KEV listing exists for CVE-2025-36050.

Detection Methods for CVE-2025-36050

Indicators of Compromise

Unexpected read access by non-root or non-QRadar service accounts to log directories under the QRadar installation path.
Presence of tools such as grep, less, cat, tail, or find executed against QRadar log files by unusual users.
Outbound transfer or archival of QRadar log files to user-writable directories or removable media.

Detection Strategies

Enable Linux audit rules (auditd) on QRadar log directories to record read syscalls (open, openat) by user and process.
Baseline the set of accounts and processes that legitimately access QRadar logs, then alert on deviations.
Correlate local shell sessions with subsequent access to sensitive log paths across the appliance fleet.

Monitoring Recommendations

Forward auditd events and shell command history from QRadar hosts to an independent log store to prevent tampering by local users.
Monitor filesystem permissions on QRadar log directories and alert on world-readable or group-readable changes.
Review privileged and service account inventories to reduce the number of principals with local login rights on the appliance.

How to Mitigate CVE-2025-36050

Immediate Actions Required

Apply the fix referenced in the IBM Security Patch Note for QRadar SIEM 7.5.
Inventory all QRadar 7.5.0 systems through Update Package 12 and prioritize patching based on data sensitivity.
Rotate credentials, tokens, and secrets that may have appeared in QRadar log files prior to remediation.
Restrict interactive local access to QRadar appliances to a minimal set of administrators.

Patch Information

IBM has published remediation guidance at IBM support page 7237317. Administrators should upgrade beyond QRadar SIEM 7.5.0 Update Package 12 using the fixed version identified in the advisory. Verify the deployed build after upgrade to confirm the affected update package is no longer present.

Workarounds

Tighten filesystem permissions on QRadar log directories so only privileged users and the QRadar service account can read them.
Remove shell access for any local accounts that do not require it, and disable password-based SSH where feasible.
Configure log rotation and secure archival to move older logs to storage that is not readable by local users.
Sanitize or scrub existing log files that already contain sensitive data after applying the vendor patch.

bash

# Configuration example: restrict QRadar log directory permissions
chown -R root:root /var/log/qradar
chmod 750 /var/log/qradar
find /var/log/qradar -type f -exec chmod 640 {} \;

# Auditd rule to record reads of QRadar log files
echo '-w /var/log/qradar -p r -k qradar_log_read' >> /etc/audit/rules.d/qradar.rules
augenrules --load