CVE-2018-1418: IBM QRadar SIEM authentication bypass leading to code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with a public exploit and very high EPSS, but exploitation requires low privileges and no KEV listing is present.

What it is

IBM Security QRadar SIEM 7.2 and 7.3 contain an improper authentication flaw (CWE-287) that lets a user bypass authentication. Because the bypass can lead to code execution, it exposes a core security monitoring platform to full compromise.

Impact

An attacker who can reach the interface gains authenticated access without valid credentials and can execute code on the QRadar system, compromising the SIEM and the data it collects.

Attack surface

The CVSS vector is network-reachable (AV:N) with low attack complexity and no user interaction, but it requires low privileges (PR:L), so some form of access or account is needed before the bypass.

Exploitation

No CISA KEV listing and no ransomware association are recorded; EPSS is high at 0.514 (98.9th percentile), and a public Exploit-DB entry (45005) exists, indicating exploit code is available.

What to do

• Apply the IBM patch referenced in the vendor advisory (swg22015797) for QRadar 7.2 and 7.3.
• Restrict network access to QRadar management and console interfaces to trusted administrative networks.
• Review and minimize accounts with low-privilege access to QRadar to reduce the preconditions for the bypass.
• Monitor for unexpected authenticated sessions or code execution on QRadar hosts after patching.

Detection

• Audit QRadar authentication logs for successful logins that do not correspond to valid credential use or expected source IPs.
• Alert on new or unusual processes spawned on QRadar hosts, especially from web or console service accounts.
• Correlate access to QRadar management interfaces from untrusted networks with subsequent authentication events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.