{"affected":[{"product":"QRadar","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"7.6.0.1","status":"affected","version":"7.6.0.0","versionType":"semver"},{"lessThanOrEqual":"7.5.0 UP 15 Interim Fix 005","status":"affected","version":"7.5.0","versionType":"semver"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_01:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14_interim_fix_02:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_01:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_02:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_03:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_15_interim_fix_04:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:-:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.6.0:fix_pack_1:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-13477","cwes":["CWE-78"],"description":"IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.","epss":{"date":"2026-11-03","percentile":0.42339,"score":0.00492},"exploits":[],"kev":null,"metrics":[{"score":4.7,"severity":"medium","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":4.7,"severity":"medium","source":"NVD: psirt@us.ibm.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793751471048,"publishedAt":1785945545698,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7282395"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7282395"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly encourages customers to update their systems promptly.\n\nProductVersionFixIBM QRadar SIEM 7.5.0  7.5.0 UP15 IF05 https://www.ibm.com/support/pages/release-qradar-750-update-package-15-interim-fix-05-sfs-202161520260715231428 IBM QRadar SIEM 7.6.0  7.6.0.2 https://www.ibm.com/support/pages/node/7280199"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7282395"}],"revision":"7b18c955c79d42ee7bb49c0c9579ae5b2f8a84a9daa9f1689c24005924452467","sources":[{"modifiedAt":1793751471048,"name":"CNA: ibm","retrievedAt":1793754658086,"url":"https://www.cve.org/CVERecord?id=CVE-2026-13477"},{"modifiedAt":1793747858063,"name":"NVD","retrievedAt":1793751421798,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13477"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748252309,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-13477"}],"ssvc":{"assessedAt":1785988533133,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"IBM QRadar SIEM is vulnerable to remote code execution by privileged users","updatedAt":1793754658086}