CVE-2025-36051: IBM QRadar SIEM Information Disclosure

CVE-2025-36051 Overview

IBM QRadar SIEM versions 7.5.0 through 7.5.0 Update Package 14 contain an information disclosure vulnerability where potentially sensitive information is stored in configuration files that could be read by a local user. This vulnerability allows unauthorized access to sensitive data that should be protected from unprivileged users on the system.

Critical Impact

Local users can access sensitive information stored in configuration files, potentially exposing credentials, API keys, or other security-critical data used by the SIEM platform.

Affected Products

• IBM QRadar SIEM 7.5.0
• IBM QRadar SIEM 7.5.0 Update Package 1 through Update Package 14

Discovery Timeline

• 2026-03-19 - CVE CVE-2025-36051 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-36051

Vulnerability Analysis

This vulnerability is classified under CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). The core issue lies in how IBM QRadar SIEM handles the storage of sensitive configuration data. When sensitive information such as credentials, connection strings, or API tokens is written to configuration files with overly permissive access controls, any local user on the system can potentially read this data.

The attack requires local access to the system, meaning an attacker would need an existing account or foothold on the QRadar appliance. However, once local access is achieved, no user interaction or elevated privileges are required to exploit the vulnerability. The impact is limited to confidentiality—the attacker can read sensitive information but cannot modify it or cause service disruption through this specific vulnerability.

Root Cause

The root cause of CVE-2025-36051 is improper access control on configuration files within the IBM QRadar SIEM installation. Configuration files containing sensitive information are stored with permissions that allow local users to read their contents. This represents a failure to implement the principle of least privilege for file system access, where sensitive data should be restricted to only the necessary service accounts and administrative users.

Attack Vector

The attack vector is local, requiring the attacker to have existing access to the IBM QRadar SIEM system. Exploitation involves navigating to the configuration file locations and reading their contents using standard file system commands. The vulnerability does not require any special tools or exploitation techniques—simply having read access to the vulnerable configuration files is sufficient.

A local attacker with shell access to the QRadar appliance could enumerate configuration directories and identify files containing sensitive information. These files may contain database credentials, API keys, integration tokens, or other sensitive data that could be leveraged for lateral movement or privilege escalation within the organization's security infrastructure.

Detection Methods for CVE-2025-36051

Indicators of Compromise

• Unusual file access patterns on QRadar configuration directories by non-administrative users
• Multiple failed or successful read attempts on configuration files from unexpected user accounts
• Evidence of credential harvesting or lateral movement following access to the QRadar system
• Anomalous user session activity on QRadar appliances

Detection Strategies

• Implement file integrity monitoring (FIM) on QRadar configuration directories to alert on unauthorized access
• Enable detailed audit logging for file system access events on the QRadar appliance
• Monitor for suspicious local user activity and privilege escalation attempts on SIEM infrastructure
• Configure SentinelOne agents to detect and alert on sensitive file access patterns

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions on QRadar appliances where supported
• Establish baseline normal file access patterns and alert on deviations
• Regularly review access logs for configuration files containing sensitive data
• Implement privileged access management (PAM) for administrative access to QRadar systems

How to Mitigate CVE-2025-36051

Immediate Actions Required

• Review and apply the security update from IBM as documented in IBM Support Page
• Audit local user accounts on QRadar appliances and remove unnecessary access
• Review configuration file permissions and restrict access to essential service accounts only
• Rotate any credentials that may have been exposed in configuration files

Patch Information

IBM has released a security update to address this vulnerability. Organizations should upgrade to IBM QRadar SIEM 7.5.0 Update Package 15 or later as soon as possible. The patch addresses the improper file permissions that allowed unauthorized access to sensitive configuration data. Detailed patch information and installation instructions are available from the IBM Support Page.

Workarounds

• Manually restrict file permissions on configuration files containing sensitive data using chmod and chown commands
• Implement additional access controls using SELinux or AppArmor policies where applicable
• Limit local shell access to QRadar appliances to only essential administrative personnel
• Deploy network segmentation to isolate QRadar infrastructure from general user networks
• Consider encrypting sensitive configuration values at rest where the application supports it

# Configuration example - Restrict configuration file permissions
# Review and harden permissions on QRadar configuration directories
# Replace /path/to/config with actual QRadar configuration paths
sudo find /opt/qradar/conf -type f -name "*.conf" -exec chmod 640 {} \;
sudo chown root:qradar /opt/qradar/conf/*.conf