CVE-2020-4888: IBM QRadar SIEM Java deserialization allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with full confidentiality, integrity and availability impact plus a very high EPSS score, though exploitation requires authenticated low-privileged access and no KEV listing exists.

What it is

IBM QRadar SIEM versions 7.4.0 through 7.4.2 Patch 1 and 7.3.0 through 7.3.3 Patch 7 deserialize user-supplied content insecurely, allowing a remote attacker to execute arbitrary commands via a malicious serialized Java object. Because QRadar is a central security monitoring platform, compromise can undermine the very visibility defenders rely on.

Impact

An attacker with a valid low-privileged account can execute arbitrary commands on the QRadar system, gaining full control over confidentiality, integrity and availability of that host.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires the attacker to hold low-level privileges (PR:L), meaning some form of authenticated access to the application is needed.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.61964, 99.1st percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Apply the IBM fix referenced in support page node/6409306 for the affected 7.3.x and 7.4.x builds.
• Restrict network access to QRadar management and console interfaces to trusted administrative networks.
• Enforce least privilege and review accounts with low-privileged access to the QRadar application.
• Monitor and alert on unexpected Java deserialization activity or unusual child processes spawned by QRadar services.

Detection

• Monitor QRadar application logs and host process telemetry for unexpected command execution or shell spawning from Java processes.
• Alert on anomalous outbound connections from QRadar hosts that could indicate post-exploitation activity.
• Audit authentication logs for use of low-privileged accounts against deserialization-exposed endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.