# CVE-2026-105473: IBM QRadar SIEM open redirect

Source: https://junglewise.ai/threats/cve-2026-105473-ibm-qradar-7-5-0-through-7-5-0-update-pack-16-interim-fix-02-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-105473 · Severity: medium · CVSS 4.6 · Published 2026-11-08

IBM QRadar SIEM is a security information and event management system that collects and analyzes security data across an organization's network. The open redirect vulnerability allows an authenticated attacker to craft a malicious link that, when clicked by a victim, redirects them to an attacker-controlled website, enabling phishing and credential theft. An attacker with knowledge of the vulnerability could deceive users into disclosing sensitive information or credentials.

Technologies: [IBM QRadar SIEM](https://junglewise.ai/threats/technologies/qradar-siem). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-105473 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105473 being exploited in the wild.

**How severe is CVE-2026-105473?** Medium severity, with a CVSS score of 4.6, published 8 November 2026.

**Which products and versions are affected?** IBM QRadar SIEM 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5.

**Is there a fix for CVE-2026-105473?** Yes: fixed in QRadar SIEM 7.6.0.6, 7.5.0 Update Pack 16 Interim Fix 03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105473 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105473?** Check whether you run IBM QRadar SIEM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in QRadar SIEM 7.6.0.6, 7.5.0 Update Pack 16 Interim Fix 03

## Technical details

This is a CWE-601 open redirect vulnerability affecting QRadar's web interface. The flaw requires a victim to be authenticated to QRadar and click a specially crafted URL; it does not allow unauthenticated exploitation. An attacker can redirect authenticated users to arbitrary external sites, potentially harvesting credentials through phishing or session hijacking.

## Affected products

- IBM QRadar SIEM 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5

## Timeline

- 2026-11-03: disclosed

## References

- [https://www.ibm.com/support/pages/node/7295450](https://www.ibm.com/support/pages/node/7295450)

## Related threats

- [IBM QRadar reflected XSS](https://junglewise.ai/threats/cve-2026-105467-ibm-qradar-7-5-0-through-7-5-0-update-pack-16-interim-fix-02-and)
- [IBM QRadar SIEM out-of-bounds read](https://junglewise.ai/threats/cve-2026-93442-ibm-qradar-siem-7-6-0-0-through-7-6-0-4-and-7-5-0-through-7-5-0)
- [IBM QRadar SIEM denial of service in HTTP Receiver](https://junglewise.ai/threats/cve-2026-93441-ibm-qradar-siem-could-allow-a-remote-attacker-to-cause-a-denial)
- [IBM QRadar SIEM backup file information disclosure](https://junglewise.ai/threats/cve-2025-33141-ibm-qradar-7-5-0-through-7-5-0-up15-interim-fix-006-could-allow)
- [IBM QRadar OS access via malicious backup archive](https://junglewise.ai/threats/cve-2024-56462-ibm-qradar-os-access-via-malicious-backup-archive)