CVE-2026-1276

Cross-site scripting (CWE-79) is when an attacker manages to sneak “bad instructions” (malicious JavaScript) into a website so that someone else’s browser runs it. In this case, a logged-in user with low privileges can inject code into the QRadar web interface, and that code could run inside another user’s active session—like slipping a counterfeit page into a trusted office binder so the next person reads and follows the attacker’s instructions.

This matters if your business uses IBM QRadar SIEM (the QRadar SIEM web interface) and you have any users who can log into it with low privileges. The attack requires the victim to be authenticated and to interact with a maliciously crafted page or input, so it’s mainly a risk where an attacker can obtain valid QRadar access and then target other users.
Reachability depends on whether attackers can reach the QRadar web interface in practice (for example, via the QRadar login and the users’ normal browser usage).

This is not a “scan the internet and get in” type bug: it needs a low-privileged authenticated user and then requires the victim to interact with a malicious input. Based on the available information, it has not been confirmed as exploited in the wild (not listed in CISA KEV and no public exploit code found), so the urgency is lower than actively exploited vulnerabilities—still, you should upgrade if you are in the affected version range.

1. Confirm your exact version/update level

   • In the QRadar SIEM admin UI or system details, identify whether you are running IBM QRadar SIEM 7.5.0.
   • Determine your current Update Package level for 7.5.0.

2. Determine whether you are affected

   • This vulnerability is described as affecting IBM QRadar SIEM 7.5.0 through Update Package 14.
   • If your system is on 7.5.0 UP15 or later, you should be past the reported vulnerable range.

3. Upgrade to the fixed version

   • Upgrade IBM QRadar SIEM 7.5.0 to UP15.
   • Use IBM’s remediation guidance and the referenced fix information from IBM Support/Fix Central.
   • Plan for any normal QRadar maintenance window and validate after upgrade that the web UI and key integrations still behave as expected.

4. Temporary risk reduction if you cannot upgrade immediately

   • Restrict access to the QRadar web interface to the smallest set of trusted users and networks (e.g., VPN/office network), reducing the chance that an attacker can obtain or use low-privileged access.
   • Review and tighten user permissions: remove unused accounts, reduce low-privilege access where possible, and ensure users only have the minimum rights needed.
   • Watch for suspicious authenticated activity and odd inputs/changes via the web UI (especially by accounts that should not have broad influence over what other users might view).

5. Monitor after remediation

   • After upgrading, continue to monitor web/UI-related logs for suspicious input patterns and unexpected account/session behavior.
   • If you see signs of malicious user actions before the fix, treat it as a potential account compromise and investigate those accounts.

6. Timing note

   • KEV was not listed for this CVE, and no public exploit code was found, but you should still address the issue as part of standard patch management for the affected version range.

Severity is reported as medium (CVSS 5.4) with network reachability but with low-privileged authenticated access required and user interaction required. The weakness is CWE-79 (cross-site scripting). Mechanism: an authenticated low-privileged user can inject arbitrary JavaScript into the IBM QRadar SIEM web interface such that it executes in another user’s browser session; this can alter UI behavior and potentially enable session credential disclosure.

Exposure assumptions from the findings: the victim must be authenticated and must interact with maliciously crafted page content or input. Exploitation status in the findings: not listed in CISA KEV and no public exploit code on record. EPSS is provided as a low predicted likelihood, but no KEV/news confirmation of active exploitation is indicated by the supplied findings.

Fix: IBM remediation guidance references an update to IBM QRadar SIEM 7.5.0 UP15 (fix central/release notes referenced in the findings), which is the stated fixed level beyond the vulnerable range (7.5.0 through Update Package 14).