# CVE-2024-56462: IBM QRadar OS access via malicious backup archive

Source: https://junglewise.ai/threats/cve-2024-56462-ibm-qradar-os-access-via-malicious-backup-archive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2024-56462 · Severity: high · CVSS 7.2 · Published 2026-05-27

IBM QRadar, a security information and event management (SIEM) platform used to monitor corporate networks for threats, is vulnerable to a security bypass. An authorized user with high-level administrative privileges can upload a specially crafted backup file that, when restored, allows them to gain full control over the underlying operating system. This could lead to a complete compromise of the security appliance and the sensitive data it manages.

Technologies: [IBM QRadar SIEM](https://junglewise.ai/threats/technologies/qradar-siem). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2024-56462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-56462 being exploited in the wild.

**How severe is CVE-2024-56462?** High severity, with a CVSS score of 7.2, published 27 May 2026.

**Which products and versions are affected?** IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 002.

**Is there a fix for CVE-2024-56462?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-56462 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-56462?** Check whether you run IBM QRadar SIEM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the backup and restore functionality of IBM QRadar (CVE-2024-56462) allows for an escape from the application layer to the underlying operating system. The flaw is categorized as CWE-530 (Exposure of Backup File to an Unauthorized Control Sphere). An attacker with high privileges (PR:H) can upload a malicious backup archive via the network. Upon restoration of this archive, the system fails to properly validate or contain the contents, allowing the attacker to execute commands or place files that grant shell access to the OS. IBM has addressed this in QRadar SIEM 7.5.0 UP15 IF03.

## Affected products

- IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 002

## Timeline

- 2026-05-27: disclosed: Initial NVD publication date
- 2026-05-27: advisory: IBM security bulletin published

## References

- [https://www.ibm.com/support/pages/node/7273957](https://www.ibm.com/support/pages/node/7273957)

## Related threats

- [IBM QRadar SIEM open redirect](https://junglewise.ai/threats/cve-2026-105473-ibm-qradar-7-5-0-through-7-5-0-update-pack-16-interim-fix-02-and)
- [IBM QRadar reflected XSS](https://junglewise.ai/threats/cve-2026-105467-ibm-qradar-7-5-0-through-7-5-0-update-pack-16-interim-fix-02-and)
- [IBM QRadar SIEM out-of-bounds read](https://junglewise.ai/threats/cve-2026-93442-ibm-qradar-siem-7-6-0-0-through-7-6-0-4-and-7-5-0-through-7-5-0)
- [IBM QRadar SIEM denial of service in HTTP Receiver](https://junglewise.ai/threats/cve-2026-93441-ibm-qradar-siem-could-allow-a-remote-attacker-to-cause-a-denial)
- [IBM QRadar SIEM backup file information disclosure](https://junglewise.ai/threats/cve-2025-33141-ibm-qradar-7-5-0-through-7-5-0-up15-interim-fix-006-could-allow)