CVE-2026-10025: IBM QRadar XXE Injection Vulnerability

CVE-2026-10025 Overview

CVE-2026-10025 is an XML External Entity (XXE) injection vulnerability in IBM QRadar SIEM. The flaw resides in the parseXmlPayload() function within the event processing pipeline packaged in q1labs_core.jar. Affected versions include IBM QRadar 7.6.0.0 through 7.6.0.1 and 7.5.0 through 7.5.0 UP 15 Interim Fix 005. When at least one log source type is configured to use XML-format property autodetection, QRadar parses XML-formatted syslog events sent to port 514 over UDP or TCP without any authentication. Remote attackers can send crafted XML payloads to disclose sensitive files and impact availability [CWE-611].

Critical Impact
Unauthenticated network attackers can exploit the XXE flaw over syslog port 514 to read local files on the QRadar appliance and degrade service availability.

Affected Products

IBM QRadar SIEM 7.6.0.0 through 7.6.0.1
IBM QRadar SIEM 7.5.0 through 7.5.0 UP 15 Interim Fix 005
Deployments with XML-format property autodetection enabled on any log source

Discovery Timeline

2026-08-05 - CVE-2026-10025 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-10025

Vulnerability Analysis

The vulnerability is an XML External Entity (XXE) injection issue tracked under [CWE-611]. IBM QRadar's event processor accepts syslog messages on port 514 over both UDP and TCP without authentication. When any configured log source type uses XML-format property autodetection, the collector routes incoming payloads to the parseXmlPayload() function inside q1labs_core.jar.

The underlying XML parser resolves external entities during document processing. An attacker who submits a crafted syslog event containing an external DOCTYPE declaration causes the parser to fetch external resources referenced by that entity. This can be used to read local files that the QRadar service account can access and to trigger blind out-of-band interactions.

Root Cause

The root cause is an insecurely configured XML parser. The parseXmlPayload() routine does not disable external entity resolution or DTD processing before parsing untrusted syslog input. Because the parsing path is exposed pre-authentication on a well-known network port, any host able to reach port 514 can supply malicious XML.

Attack Vector

Exploitation requires network access to the QRadar event collector on UDP or TCP port 514. The attacker sends a syslog message whose body is an XML document containing a malicious external entity declaration referencing a local file path or an attacker-controlled URL. When the log source type is set to XML autodetection, QRadar parses the payload and resolves the entity, returning file contents through parsed fields or leaking data via out-of-band DNS or HTTP requests. No credentials, user interaction, or prior access to QRadar are required.

// Example exploitation pattern (conceptual, sanitized)
// The attacker sends a syslog message over UDP/TCP 514 whose body is an
// XML document declaring an external entity that references a local file
// or attacker-controlled URL. When parseXmlPayload() processes the document
// with DTD and external entity resolution enabled, the referenced resource
// is fetched and its contents are incorporated into parsed event fields.
// See the IBM Support advisory for authoritative technical details.

Detection Methods for CVE-2026-10025

Indicators of Compromise

Syslog messages arriving on UDP or TCP port 514 whose payloads begin with <?xml or contain <!DOCTYPE and <!ENTITY declarations.
Outbound DNS or HTTP requests initiated by the QRadar host to unfamiliar external domains shortly after receiving XML-formatted syslog events.
Unexpected reads of sensitive files such as /etc/passwd, QRadar configuration files, or private keys by the QRadar service account.
Parsed event fields containing fragments of local file contents or file paths that do not match the log source's normal schema.

Detection Strategies

Inspect network traffic to QRadar collectors for syslog payloads containing XML DOCTYPE or ENTITY tokens and alert on matches.
Enable QRadar audit logging and correlate log source parsing errors with anomalous outbound network activity from the appliance.
Baseline expected outbound connections from QRadar hosts and flag deviations, especially DNS resolutions to newly observed domains.

Monitoring Recommendations

Forward QRadar system, deployment, and audit logs to an independent analytics tier for tamper-resistant review.
Monitor the QRadar appliance file system for reads of sensitive paths outside routine operational patterns.
Track configuration changes to log source types that enable XML property autodetection and alert on new activations.

How to Mitigate CVE-2026-10025

Immediate Actions Required

Apply the fixed IBM QRadar release identified in the IBM Support Page as soon as change control permits.
Restrict inbound access to UDP and TCP port 514 to trusted log source subnets using network access control lists or host firewalls.
Audit configured log source types and disable XML-format property autodetection where it is not required.
Rotate credentials, API tokens, and certificates stored on the QRadar appliance if compromise is suspected.

Patch Information

IBM has published remediation guidance and fixed builds through the IBM Support Page. Administrators should upgrade IBM QRadar 7.6.0.x and 7.5.0 UP 15 IF005 or earlier to the versions listed in the advisory. Verify checksums and follow IBM's documented upgrade procedure to preserve deployment integrity.

Workarounds

Block or filter untrusted sources from reaching port 514 on QRadar event collectors until the patch is deployed.
Remove or reconfigure log source types that rely on XML property autodetection so incoming XML payloads are not routed to parseXmlPayload().
Place QRadar collectors behind a syslog relay that strips or rejects payloads containing <!DOCTYPE or <!ENTITY declarations.

bash

# Example: restrict inbound syslog on port 514 to trusted subnets only
# Adjust the trusted CIDR to match your log source network
sudo iptables -A INPUT -p udp --dport 514 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 514 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 514 -j DROP
sudo iptables -A INPUT -p tcp --dport 514 -j DROP