CVE-2026-105473: IBM QRadar SIEM open redirect

CVE-2026-105473 · Severity: medium · CVSS 4.6 · Published 2026-11-08

IBM QRadar SIEM is a security information and event management system that collects and analyzes security data across an organization's network. The open redirect vulnerability allows an authenticated attacker to craft a malicious link that, when clicked by a victim, redirects them to an attacker-controlled website, enabling phishing and credential theft. An attacker with knowledge of the vulnerability could deceive users into disclosing sensitive information or credentials.

Technologies: IBM QRadar SIEM. Vendors: IBM.

Quick answers

Is CVE-2026-105473 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105473 being exploited in the wild.
How severe is CVE-2026-105473?
Medium severity, with a CVSS score of 4.6, published 8 November 2026.
Which products and versions are affected?
IBM QRadar SIEM 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5.
Is there a fix for CVE-2026-105473?
Yes: fixed in QRadar SIEM 7.6.0.6, 7.5.0 Update Pack 16 Interim Fix 03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105473 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-105473?
Check whether you run IBM QRadar SIEM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: QRadar SIEM 7.6.0.6, 7.5.0 Update Pack 16 Interim Fix 03

Technical details

This is a CWE-601 open redirect vulnerability affecting QRadar's web interface. The flaw requires a victim to be authenticated to QRadar and click a specially crafted URL; it does not allow unauthenticated exploitation. An attacker can redirect authenticated users to arbitrary external sites, potentially harvesting credentials through phishing or session hijacking.

Affected products

  • IBM QRadar SIEM 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5

Timeline

  • 2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.