IBM QRadar SIEM 7.5.0 through 7.6.0.5 contains a reflected cross‑site scripting flaw that is triggered when an authenticated user opens a specially crafted URL. The vulnerability can allow an attacker to inject arbitrary JavaScript into the victim’s session, facilitating the theft of credentials, unauthorized actions, or malicious content injection. This weakness is identified as CWE‑79 and poses a high attack surface whenever an internal user follows a malicious link.

The affected vendor is IBM and the product is QRadar SIEM. The vulnerable releases include QRadar 7.5.0 with Update Pack 16 Interim Fix 02 and QRadar 7.6.0.0 through QRadar 7.6.0.5. Fixed releases begin with QRadar 7.6.0.6 and QRadar 7.5.0 UP16 IF03.

The CVSS score of 8.1 indicates a high severity, but the EPSS score is not provided and the issue is not listed in the CISA KEV catalog. Exploitation requires that the target is authenticated, and the attacker must send the victim a crafted URL that the victim then opens. While user interaction is required, the attack can be launched from any remote site with a malicious link, making this a serious threat to internal users who are unaware of the risk.