CVE-2020-4280: IBM QRadar SIEM Java deserialization remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote command execution in a central SIEM with public exploit code and very high EPSS, tempered only by the low-privilege requirement and absence from KEV.

What it is

IBM QRadar SIEM 7.3 and 7.4 deserialize user-supplied content insecurely, allowing a remote attacker to send a malicious serialized Java object and execute arbitrary commands. Because QRadar is a central SIEM, compromise of the server undermines the monitoring and log data it is meant to protect.

Impact

An attacker who can reach the vulnerable endpoint gains arbitrary command execution on the QRadar system, with high impact to confidentiality, integrity and availability per the CVSS vector.

Attack surface

Reached over the network (AV:N) with low attack complexity and no user interaction; the CVSS vector requires low privileges (PR:L), so some level of access or authentication is needed before exploitation.

Exploitation

Public exploit code is referenced (Packet Storm and Full Disclosure entries tagged Exploit), and EPSS is very high at 0.73451 (99.4th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the IBM fix referenced in the vendor advisory (support page node/6344079) for QRadar 7.3 and 7.4.
• Restrict network access to QRadar management and API interfaces to trusted hosts and networks.
• Enforce least privilege and review accounts that can reach the vulnerable deserialization endpoint.
• Monitor for and block serialized Java object payloads at ingress where feasible.

Detection

• Alert on unexpected child processes spawned by QRadar Java processes, especially shells or command interpreters.
• Inspect network traffic and logs for serialized Java object payloads (for example base64 or hex streams beginning with rO0 or aced0005) sent to QRadar endpoints.
• Review QRadar and host logs for anomalous outbound connections or command execution following suspicious API or web requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.