An unauthenticated XML External Entity (XXE) vulnerability in IBM QRadar versions 7.6.0 and 7.5.0 allows attackers to access sensitive system files.

This is an XXE vulnerability (CWE-611) that occurs due to improper restriction of XML external entity references. It is remotely exploitable by an unauthenticated attacker.

The ability for an unauthenticated attacker to perform file disclosure poses a high risk to organizational data. The CVSS score of 8.2 reflects the severity, as this could lead to the exposure of configuration files, credentials, or sensitive system information, significantly undermining the security of the SIEM platform.

Immediate Action: Apply the specific patches provided by IBM: update to 7.6.0.2 for version 7.6.0, or apply the 7.5.0 UP15 IF05 Hotfix 20260715231428 for version 7.5.0.

Proactive Monitoring: Monitor network traffic and server logs for XML-based payloads or anomalous requests aimed at system files.

Compensating Controls: Utilize a WAF to block requests containing DOCTYPE declarations or external entity references that are characteristic of XXE attacks.

Public Exploit Available: Unknown

Given the lack of authentication requirements for this exploit, it represents a high-priority risk. Security teams should expedite the deployment of the specified hotfixes and patches to ensure the integrity and confidentiality of the QRadar deployment.