IBM QRadar SIEM 7.5.0 through Update Pack 14 contains a stored cross‑site scripting flaw that allows an authenticated user to inject and execute arbitrary JavaScript within the web interface, potentially exfiltrating session credentials or performing actions on behalf of the user. This is a classic XSS weakness, identified as CWE‑79, which directly compromises the confidentiality of session data.

The vulnerability affects IBM QRadar SIEM version 7.5.0 and any of its Update Packs 1 through 14. Systems running these versions or applying any of the listed update packs are at risk.

With a CVSS score of 5.4 and an EPSS of less than 1 %, exploitation is moderately difficult and unlikely to be widely automated. The vulnerability requires an authenticated user with access to the UI, implying that attackers must first compromise or gain legitimate credentials. Because the flaw is not listed in CISA’s KEV catalog, it is not known to be actively exploited in the wild. Nevertheless, attackers could leverage this to hijack sessions and exfiltrate sensitive credentials within an otherwise trusted session.