SB2026072807 - Multiple vulnerabilities in IBM QRadar SIEM

Description

This security bulletin contains information about 27 vulnerabilities.

1) Open redirect (CVE-ID: CVE-2026-25854)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect users to an arbitrary URI.

The vulnerability exists due to improper input validation in LoadBalancerDrainingValve when handling a specially crafted URL while a Tomcat node is in the disabled (draining) state. A remote attacker can send a specially crafted URL to redirect users to an arbitrary URI.

Only clustered deployments using LoadBalancerDrainingValve in the disabled (draining) state are affected.

2) LDAP injection (CVE-ID: CVE-2026-0636)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to manipulate LDAP queries.

The vulnerability exists due to improper neutralization of special elements used in an LDAP query in LDAPStoreHelper when processing user-supplied input for LDAP queries. A remote attacker can supply crafted input to manipulate LDAP queries.

This issue is associated with the prov modules.

3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-27830)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to unsafe deserialization in the userOverridesAsString property of c3p0 ConnectionPoolDataSource implementations when processing maliciously crafted Java-serialized objects or javax.naming.Reference instances. A remote user can reset this property or supply crafted serialized objects or references to execute arbitrary code.

The impact can be amplified when embedded JNDI references trigger dereferencing of a remote factoryClassLocation.

4) Out-of-bounds read (CVE-ID: CVE-2025-12183)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform a denial of service attack.

The vulnerability exists due to a boundary condition. A remote attacker can pass specially crafted compressed input to the application, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.

5) Information disclosure (CVE-ID: CVE-2025-66566)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the application insufficiently clears the output buffer in Java-based decompressor implementations. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.

Note, JNI-based implementations are not affected.

6) Improper validation of certificate with host mismatch (CVE-ID: CVE-2025-68161)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the Socket Appender does not perform TLS hostname verification of the peer certificate, even when the "verifyHostName" configuration attribute or the "log4j2.sslVerifyHostName"  system property is set to true. A remote attacker can perform MitM attack and intercept or redirect the log traffic. 

7) Improper input validation (CVE-ID: CVE-2026-27727)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Platform Security (Mchange Commons Java) component in Oracle Business Intelligence Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

8) Integer overflow (CVE-ID: CVE-2025-66168)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to integer overflow within the MQTT module when decoding malformed packets. A remote user can send specially crafted packets to the application, trigger an integer overflow and perform a denial of service attack. Note, the vulnerability does not affect brokers with not enabled MQTT transport connectors.

9) Integer overflow (CVE-ID: CVE-2026-40046)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in the MQTT control packet remaining length field handling when parsing MQTT control packets. A remote attacker can send a specially crafted MQTT control packet to cause a denial of service.

10) Code Injection (CVE-ID: CVE-2026-34197) Exploited

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to code injection in the Jolokia JMX-HTTP bridge and exposed ActiveMQ MBeans when handling authenticated exec operations with a crafted discovery URI. A remote user can invoke BrokerService.addNetworkConnector(String) or BrokerService.addConnector(String) to execute arbitrary code.

The issue is exposed through the web console endpoint at /api/jolokia/, and exploitation causes remote Spring XML application context loading via the VM transport's brokerConfig parameter before configuration validation completes.

11) Race condition (CVE-ID: CVE-2026-35554)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N]

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. A remote attacker can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

12) Path traversal (CVE-ID: CVE-2026-33227)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to load unintended classpath resources.

The vulnerability exists due to path traversal in Stomp consumer creation and Web console message browsing when processing an authenticated user-supplied key value. A remote user can supply a crafted key value to load unintended classpath resources.

The issue occurs in two instances: when creating a Stomp consumer and when browsing messages in the Web console, and it could potentially be chained with another attack to lead to further exploit.

13) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-24880)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to improper input validation in HTTP/1.1 chunk extension handling when parsing chunked requests. A remote attacker can send a specially crafted request with an invalid chunk extension to perform request smuggling.

Exploitation requires a reverse proxy in front of Tomcat that allows CRLF sequences in an otherwise valid chunk extension.

14) Incorrect calculation (CVE-ID: CVE-2025-14813)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause cryptographic operations to fail.

The vulnerability exists due to improper implementation in G3413CTRBlockCipher when encrypting or decrypting more than 255 blocks. A remote attacker can supply data that exceeds this limit to cause cryptographic operations to fail.

The issue affects the GOST-R-3413-2015 CTR mode implementation because it uses a single-byte counter instead of a counter size aligned with the algorithm definition.

15) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2026-29146)

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to decrypt protected communications.

The vulnerability exists due to the use of a padding-oracle-prone cryptographic mode in EncryptInterceptor when processing encrypted traffic with the default CBC configuration. A remote attacker can perform a padding oracle attack to decrypt protected communications.

16) Covert Timing Channel (CVE-ID: CVE-2026-5598)

CWE-ID: CWE-385 - Covert Timing Channel

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a covert timing channel in FrodoEngine.java in the BC-JAVA core modules when performing cryptographic operations. A remote attacker can measure timing differences to disclose sensitive information.

17) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34483)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject arbitrary JSON into the JSON access log.

The vulnerability exists due to incomplete escaping in the JSON access log when handling requests with non-default Connector attributes relaxedPathChars and/or relaxedQueryChars. A remote attacker can send a specially crafted request to inject arbitrary JSON into the JSON access log.

Only configurations using non-default values for relaxedPathChars and/or relaxedQueryChars are affected.

18) Improper Certificate Validation (CVE-ID: CVE-2026-34500)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass client certificate authentication.

The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when processing OCSP checks with FFM and soft-fail disabled. A remote user can present a certificate in affected scenarios to bypass client certificate authentication.

Only some scenarios using FFM are affected.

19) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-34487)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log output in the cloud membership for clustering component when writing log messages. A remote attacker can trigger log entries that expose the Kubernetes bearer token to disclose sensitive information.

20) Buffer overflow (CVE-ID: CVE-2026-2006)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to missing validation of multibyte character length. A remote user can send a specially crafted query to the application, trigger memory corruption and execute arbitrary code on the target system.

21) Heap-based buffer overflow (CVE-ID: CVE-2026-2005)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in pgcrypto. A remote user can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

22) Type confusion (CVE-ID: CVE-2026-2004)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in intarray extension. A remote user can pass specially crafted data to the application, trigger a type confusion error and execute arbitrary code on the target system.

23) Improper Validation of Syntactic Correctness of Input (CVE-ID: CVE-2026-40198)

CWE-ID: CWE-1286 - Improper Validation of Syntactic Correctness of Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to modify data on the system.

The vulnerability exists due to the application does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17). The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range. A remote attacker can gain unauthorized access to sensitive information on the system.

24) Improper authorization (CVE-ID: CVE-2021-47154)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper input validation when processing extraneous zero characters at the beginning of an IP address string. A remote attacker can bypass access restrictions based on IP addresses.

25) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-40199)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to application mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address. The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses. A remote attacker can gain unauthorized access to sensitive information on the system.

26) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-39304)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of TLSv1.3 KeyUpdate messages in ActiveMQ NIO SSL transports when processing client-triggered TLSv1.3 handshake KeyUpdates. A remote attacker can rapidly trigger KeyUpdate messages to cause a denial of service.

Only TLSv1.3 is vulnerable to out-of-memory exhaustion; earlier TLS versions may cause a connection hang instead.

27) Improper Certificate Validation (CVE-ID: CVE-2026-29145)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass certificate revocation checks during authentication.

The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when processing OCSP checks in some scenarios with soft fail disabled. A remote user can present a certificate in affected scenarios to bypass certificate revocation checks during authentication.

Only some scenarios are affected when soft fail is disabled.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7280950