CVE-2025-13995 in QRadar
Summary
by MITRE • 03/19/2026
IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/23/2026
IBM QRadar SIEM version 7.5.0 through 7.5.0 Update Package 14 contains a critical tenant isolation vulnerability that undermines the fundamental security architecture of the platform. This vulnerability stems from inadequate isolation mechanisms between multi-tenant environments, allowing an attacker who has gained access to one tenant's account to potentially extract hostname data from other tenants within the same system. The flaw represents a significant bypass of the expected security boundaries that should prevent cross-tenant data leakage and unauthorized information access.
The technical implementation of this vulnerability manifests through insufficient input validation and access control enforcement within the tenant management subsystem. When a malicious actor compromises a single tenant account, they can exploit a weakness in the data access layer that fails to properly validate tenant boundaries during hostname data retrieval operations. This allows for unauthorized data enumeration and potential information disclosure across tenant silos. The vulnerability aligns with CWE-284 Access Control Issues, specifically targeting insufficient enforcement of access control mechanisms between isolated tenant environments. From an operational security perspective, this weakness creates a pathway for lateral movement and data exfiltration that can escalate to full system compromise if additional attack vectors are present.
The impact of this vulnerability extends beyond simple data leakage as it enables reconnaissance activities that can facilitate more sophisticated attacks. An attacker with access to one tenant can gather hostname information from other tenants, potentially identifying system configurations, network topology details, and operational patterns that could be leveraged for targeted attacks. This cross-tenant data access capability significantly increases the attack surface for organizations relying on QRadar's multi-tenant architecture. The vulnerability particularly affects organizations with shared infrastructure deployments where multiple clients or departments utilize the same QRadar instance, making it a critical concern for managed security service providers and large enterprise environments.
Organizations should immediately implement mitigations including enhanced access control measures, network segmentation between tenant environments, and comprehensive monitoring of cross-tenant data access patterns. The recommended approach involves applying the latest IBM security patches and updates as soon as they become available, while also implementing additional administrative controls such as role-based access restrictions and audit logging for all tenant data access operations. Security teams should conduct immediate vulnerability assessments to identify any existing compromised tenant accounts and establish monitoring procedures to detect unauthorized cross-tenant data access attempts. This vulnerability demonstrates the critical importance of maintaining proper multi-tenant isolation boundaries and aligns with ATT&CK technique T1087.001 Account Discovery, as it enables unauthorized enumeration of system accounts and resources across tenant boundaries. Organizations must also consider implementing additional security controls such as data loss prevention mechanisms and network access controls to minimize the potential impact of this and similar vulnerabilities.