CVE-2018-1612: IBM QRadar Incident Forensics authentication bypass exposes data

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote information exposure in a security platform, with public exploit code and very high EPSS, though CVSS impact is limited to confidentiality.

What it is

IBM QRadar Incident Forensics, part of QRadar SIEM 7.2 and 7.3, allows a remote attacker to bypass authentication and obtain sensitive information. The flaw is an information exposure issue (CWE-200) reachable over the network without credentials, which matters because QRadar is a security monitoring platform holding sensitive event and forensic data.

Impact

An unauthenticated remote attacker can bypass authentication and read sensitive information from the affected QRadar component. The CVSS vector limits direct impact to confidentiality (C:L) with no integrity or availability effect.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), per the CVSS vector; the description confirms a remote attacker can bypass authentication. The record does not specify which interface or endpoint is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.56952 (99th percentile) and a public Exploit-DB entry (45005) exists, indicating exploit code is publicly available.

What to do

• Apply the IBM fix referenced in the vendor advisory (swg22017062) for QRadar SIEM 7.2 and 7.3.
• Restrict network access to QRadar Incident Forensics interfaces to trusted management networks only.
• Review QRadar deployment for unnecessary internet or broad internal exposure and segment accordingly.
• Monitor for and investigate unexpected unauthenticated access to QRadar forensic data.

Detection

• Review QRadar and web/proxy logs for unauthenticated requests to Incident Forensics endpoints returning data.
• Alert on access to forensic case or evidence data from unusual source IPs or outside normal admin workflows.
• Correlate Exploit-DB 45005 style request patterns against QRadar access logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.