CVE-2025-36379: IBM QRadar EDR Weak Cryptography Flaw

CVE-2025-36379 Overview

CVE-2025-36379 is a cryptographic vulnerability affecting IBM Security QRadar EDR (formerly IBM Security ReaQta) that uses weaker than expected cryptographic algorithms. This weakness could allow an attacker to decrypt highly sensitive information transmitted or stored by the endpoint detection and response platform.

Critical Impact

Attackers exploiting this vulnerability may be able to decrypt sensitive security telemetry, detection data, or other confidential information processed by the QRadar EDR solution.

Affected Products

• IBM Security QRadar EDR versions 3.12 through 3.12.23
• IBM Security ReaQta (legacy naming)

Discovery Timeline

• 2026-02-17 - CVE CVE-2025-36379 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-36379

Vulnerability Analysis

This vulnerability falls under CWE-326 (Inadequate Encryption Strength), indicating that IBM Security QRadar EDR implements cryptographic algorithms that do not provide sufficient protection for sensitive data. The weakness requires network access to exploit but involves high attack complexity, meaning successful exploitation requires specific conditions to be met.

When an EDR platform uses weak cryptographic algorithms, the confidentiality of all data protected by those algorithms is at risk. In the context of security tooling like QRadar EDR, this could expose threat intelligence, endpoint telemetry, detection rules, or other sensitive security data that organizations rely on to protect their infrastructure.

Root Cause

The root cause is the implementation of cryptographic algorithms that do not meet current security standards for protecting sensitive information. This may include the use of deprecated cipher suites, insufficient key lengths, or outdated cryptographic protocols that have known weaknesses.

Attack Vector

The attack vector is network-based, requiring an attacker to intercept or access encrypted communications or stored data. The high attack complexity suggests that exploitation requires the attacker to overcome additional barriers such as specific network positioning, timing conditions, or prerequisite access to encrypted material.

An attacker with network access could potentially capture encrypted traffic between QRadar EDR components or endpoints and, given sufficient time and resources, decrypt the captured data to access sensitive security information. This could compromise incident response operations, expose detection capabilities, or reveal confidential threat intelligence.

Detection Methods for CVE-2025-36379

Indicators of Compromise

• Unusual network traffic patterns suggesting cryptographic downgrade attacks against QRadar EDR communications
• Evidence of traffic interception or man-in-the-middle positioning targeting QRadar EDR network segments
• Unauthorized access attempts to encrypted data stores or configuration files

Detection Strategies

• Monitor network traffic for deprecated cipher suite negotiations involving QRadar EDR components
• Implement TLS inspection to identify weak cryptographic protocol usage
• Review QRadar EDR logs for anomalous authentication or data access patterns
• Deploy network security monitoring on segments containing QRadar EDR infrastructure

Monitoring Recommendations

• Enable verbose logging for QRadar EDR cryptographic operations where available
• Monitor for certificate-related errors or warnings that may indicate exploitation attempts
• Implement alerting for network anomalies targeting QRadar EDR management interfaces
• Review access logs for the QRadar EDR console and API endpoints

How to Mitigate CVE-2025-36379

Immediate Actions Required

• Review current IBM Security QRadar EDR version and determine if within affected range (3.12 through 3.12.23)
• Consult the IBM Support Page for patch availability and upgrade instructions
• Implement network segmentation to limit exposure of QRadar EDR traffic
• Enable additional network encryption layers (VPN, IPsec) for QRadar EDR communications where feasible

Patch Information

IBM has published a security advisory addressing this vulnerability. Organizations should consult the IBM Support Page for the latest patch information, upgrade instructions, and specific remediation guidance for their deployment.

Workarounds

• Restrict network access to QRadar EDR components to trusted management networks only
• Implement additional transport layer encryption for QRadar EDR communications
• Monitor for and block known weak cipher suite negotiations at the network perimeter
• Consider deploying network-level encryption overlays until patches can be applied