# CVE-2026-91869: IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.

## Remediation

- fix: IBM encourages customers to update their systems promptly.

ProductFix versionIBM Security QRadar EDR3.12.27







The IBM Security QRadar EDR operator can be upgraded automatically when new compatible versions are available. However, you can control whether an operator is upgraded automatically by setting an approval strategy.



Two approval strategies are available:

  *  Automatic (default) - New operator versions are installed automatically when they are available on the subscription channel.
  *  Manual - When a new operator version is available on the subscription channel, the subscription indicates that an update is available, but you must approve the update manually.




For more information about the manual installation process, view  Installing QRadar EDR https://www.ibm.com/docs/en/security-qradar-edr/3.12 (source: CNA: ibm)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: ibm) — https://www.ibm.com/support/pages/node/7296309

## Affected products and versions

- IBM / Security QRadar EDR: ≥ 3.12.0; ≤ 3.12.26 (affected, semver). Source: CNA: ibm

## Severity and prioritization

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; source: CNA: ibm

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; source: NVD: psirt@us.ibm.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-307

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.ibm.com/support/pages/node/7296309 (CNA: ibm; vendor-advisory, patch)

- https://www.ibm.com/support/pages/node/7296309 (psirt@us.ibm.com)

## Provenance

- CNA: ibm: https://www.cve.org/CVERecord?id=CVE-2026-91869; retrieved 2026-11-13; source updated 2026-11-13

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91869; retrieved 2026-11-14; source updated 2026-11-13

Revision: dbff7362eb2a578648885362d1363197e5ad26aabaf533f5d3a62596244eda54

Canonical: https://y2.dev/cve/CVE-2026-91869

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.