# CVE-2026-93441: IBM QRadar SIEM denial of service in HTTP Receiver

Source: https://junglewise.ai/threats/cve-2026-93441-ibm-qradar-siem-could-allow-a-remote-attacker-to-cause-a-denial  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-93441 · Severity: high · CVSS 8.6 · Published 2026-10-20

IBM QRadar SIEM is a security information and event management platform used to monitor and analyze security events across enterprise networks. When the HTTP Receiver protocol is enabled, a remote attacker can send specially crafted requests that consume excessive system resources, causing the system to become unavailable and interrupting security monitoring across the organization.

Technologies: [IBM QRadar SIEM](https://junglewise.ai/threats/technologies/qradar-siem). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-93441 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93441 being exploited in the wild.

**How severe is CVE-2026-93441?** High severity, with a CVSS score of 8.6, published 20 October 2026.

**Which products and versions are affected?** IBM QRadar SIEM 7.4-20210823144546 through 7.5-20260930064858, 7.6-20260330053257 through 7.6-20260930064910.

**Is there a fix for CVE-2026-93441?** Yes: fixed in QRadar SIEM 7.5 (PROTOCOL-HTTPReceiver-7.5-20260930064859), 7.6 (PROTOCOL-HTTPReceiver-7.6-20260930064911). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93441 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93441?** Check whether you run IBM QRadar SIEM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in QRadar SIEM 7.5 (PROTOCOL-HTTPReceiver-7.5-20260930064859), 7.6 (PROTOCOL-HTTPReceiver-7.6-20260930064911)

## Technical details

The HTTP Receiver protocol in IBM QRadar SIEM is vulnerable to uncontrolled resource consumption (CWE-400), allowing remote unauthenticated attackers to trigger a denial of service. The vulnerability requires only network access and no user interaction, and can impact system availability across customers (scope change). A fix is available via patched RPM packages for versions 7.5 and 7.6.

## Affected products

- IBM QRadar SIEM 7.4-20210823144546 through 7.5-20260930064858, 7.6-20260330053257 through 7.6-20260930064910

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.ibm.com/support/pages/node/7292244](https://www.ibm.com/support/pages/node/7292244)

## Related threats

- [IBM QRadar SIEM open redirect](https://junglewise.ai/threats/cve-2026-105473-ibm-qradar-7-5-0-through-7-5-0-update-pack-16-interim-fix-02-and)
- [IBM QRadar reflected XSS](https://junglewise.ai/threats/cve-2026-105467-ibm-qradar-7-5-0-through-7-5-0-update-pack-16-interim-fix-02-and)
- [IBM QRadar SIEM out-of-bounds read](https://junglewise.ai/threats/cve-2026-93442-ibm-qradar-siem-7-6-0-0-through-7-6-0-4-and-7-5-0-through-7-5-0)
- [IBM QRadar SIEM backup file information disclosure](https://junglewise.ai/threats/cve-2025-33141-ibm-qradar-7-5-0-through-7-5-0-up15-interim-fix-006-could-allow)
- [IBM QRadar OS access via malicious backup archive](https://junglewise.ai/threats/cve-2024-56462-ibm-qradar-os-access-via-malicious-backup-archive)