IBM QRadar Suite Software and IBM Cloud Pak for Security code injection

Successful exploitation of CVE-2025-25021 could allow an attacker to gain complete control over the affected QRadar or Cloud Pak for Security system. This could involve data exfiltration, system modification, or the deployment of malicious software. Given QRadar's role in security information and event management (SIEM), a compromise could lead to the attacker gaining visibility into the entire organization's security posture and potentially manipulating security responses. The ability to execute code with privileged access significantly expands the attack surface and increases the potential for lateral movement within the network. This vulnerability shares characteristics with other code injection flaws where improper input validation leads to arbitrary code execution, potentially allowing for persistent backdoor access.

Organizations heavily reliant on IBM QRadar Suite Software for security monitoring and incident response are particularly at risk. This includes those with complex security environments, extensive log data processing, and potentially those with legacy QRadar deployments that may be slower to patch. Shared hosting environments utilizing QRadar instances are also at increased risk due to potential cross-tenant vulnerabilities.

• linux / server:

journalctl -u qradar | grep -i "case management script"

• generic web:

curl -I <qradar_url>/case_management_script_endpoint

• database (mysql):

SELECT * FROM scripts WHERE script_type = 'case_management' AND script_content LIKE '%malicious_code%';

1. 2025-06-03Disclosure

   disclosure

1. Gereserveerd2025-01-31
2. Gepubliceerd2025-06-03
3. Gewijzigd2026-02-26
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-25021 is to upgrade to a patched version of IBM QRadar Suite Software or IBM Cloud Pak for Security as soon as possible. IBM has released updates to address this vulnerability; refer to their security advisory for specific version details. If immediate patching is not feasible, consider implementing temporary workarounds such as restricting access to the case management script creation functionality and carefully reviewing any newly created scripts for suspicious code. While not a complete solution, restricting user permissions and implementing strict input validation on script parameters can reduce the attack surface. After upgrading, verify the fix by attempting to create a case management script with potentially malicious code and confirming that it is properly sanitized and does not execute.