IBM QRadar SIEM versions 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02 and 7.6.0.0 to 7.6.0.5 contain a vulnerability that allows an authenticated user to trigger an open redirect by opening a specifically crafted URL. The redirect can lead a victim to a malicious domain, enabling phishing or malicious content delivery. Because the redirect is reflected in the response, it also falls under reflected XSS, potentially injecting malicious code into the victim's browser. The weakness is categorized as CWE-601, indicating improper validation of redirect URLs.

Affected systems include IBM QRadar SIEM 7.5.0, all later update packs up to and including Update Pack 16 Interim Fix 02, as well as IBM QRadar SIEM 7.6.0.0 through 7.6.0.5. The patch versions IBM QRadar SIEM 7.6.07.6.0.6 and 7.5.07.5.0 UP16 IF03 address this issue.

The CVSS base score of 4.6 indicates a moderate severity, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of an authenticated QRadar session, suggesting the threat is primarily internal. An attacker could redirect users to malicious sites, potentially facilitating credential theft or malware delivery. Because the exploit relies on a crafted URL, it is limited to users who are able to manipulate or share such links within the QRadar environment.