CVE-2025-36377: IBM QRadar EDR Auth Bypass Vulnerability

CVE-2025-36377 Overview

IBM Security QRadar EDR versions 3.12 through 3.12.23 contains an Insufficient Session Expiration vulnerability (CWE-613) that fails to properly invalidate sessions after they expire. This security flaw could allow an authenticated user to impersonate another user on the system by exploiting stale session tokens that remain valid beyond their intended lifetime.

Critical Impact

Authenticated attackers can leverage expired sessions to perform unauthorized actions and impersonate other users, potentially gaining access to sensitive security data and EDR management functions.

Affected Products

• IBM Security QRadar EDR 3.12
• IBM Security QRadar EDR 3.12.1 through 3.12.23

Discovery Timeline

• 2026-02-17 - CVE-2025-36377 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-36377

Vulnerability Analysis

This vulnerability stems from improper session lifecycle management within IBM Security QRadar EDR. When a user's session reaches its configured expiration time, the application fails to properly invalidate the session token on the server side. This creates a window of opportunity where session tokens that should be invalid can still be used to authenticate requests.

The impact of this flaw is significant in an enterprise security context. QRadar EDR is designed to provide endpoint detection and response capabilities, meaning compromised sessions could grant attackers access to security telemetry, threat investigation data, and potentially the ability to modify security policies or response actions.

Root Cause

The root cause is classified under CWE-613 (Insufficient Session Expiration). The application does not properly track and invalidate session tokens when they reach their expiration threshold. This likely results from sessions being validated only against their initial creation parameters without proper server-side timeout enforcement.

Attack Vector

The attack requires network access and low-privilege authentication to the QRadar EDR system. An attacker who has previously authenticated (or obtained a valid session token through other means) can continue using that session even after the configured timeout period has elapsed. This allows the attacker to maintain unauthorized access and potentially impersonate legitimate users whose sessions should have been terminated.

The exploitation scenario involves capturing or retaining session tokens (through network interception, browser history, or other means) and then replaying those tokens after the legitimate user's session should have expired. Since the server fails to properly invalidate expired sessions, these stale tokens remain functional.

Detection Methods for CVE-2025-36377

Indicators of Compromise

• Session tokens being used significantly after their expected expiration time
• User activity from the same session token across unusual time gaps
• Authentication logs showing session reuse after logout events

Detection Strategies

• Monitor QRadar EDR authentication logs for sessions that remain active beyond configured timeout thresholds
• Implement log correlation rules to detect session tokens used from multiple IP addresses or after extended periods of inactivity
• Review audit trails for user actions that occur after expected session termination times

Monitoring Recommendations

• Enable detailed session logging within IBM Security QRadar EDR to capture session lifecycle events
• Configure SIEM alerts for anomalous session duration patterns
• Regularly audit active sessions and compare against expected user activity windows

How to Mitigate CVE-2025-36377

Immediate Actions Required

• Upgrade IBM Security QRadar EDR to a patched version beyond 3.12.23
• Implement shorter session timeout values to reduce the exploitation window
• Review and terminate any suspicious active sessions within the QRadar EDR console
• Enable multi-factor authentication if available to add additional security layers

Patch Information

IBM has released security updates to address this vulnerability. Administrators should consult the IBM Support Page for detailed patch information and upgrade instructions. Apply the latest available security updates for IBM Security QRadar EDR versions in the affected range (3.12 through 3.12.23).

Workarounds

• Reduce session timeout values to minimize the window where expired sessions could be exploited
• Implement network segmentation to limit access to the QRadar EDR management interface
• Enable IP-based session binding if supported to prevent session reuse from different network locations
• Monitor for and manually terminate idle sessions on a regular basis

# Session management recommendation
# Reduce session timeout values in QRadar EDR configuration
# Consult IBM documentation for specific configuration parameters
# Example: Set session timeout to 15 minutes or less for administrative sessions