Access Control Flaw in IBM Security QRadar EDR Affects User Data
CVE-2026-91868

6.5MEDIUM

Key Information:

Vendor

IBM
Status
Security Qradar Edr
Vendor
CVE Published:
13 November 2026

What is CVE-2026-91868?

A critical access control vulnerability exists in IBM Security QRadar EDR versions 3.12 to 3.12.26, enabling authenticated remote attackers to exploit improper access control mechanisms. This flaw may lead to unauthorized disclosure of sensitive information, potentially jeopardizing the confidentiality of user data and overall security posture. Organizations using affected versions should prioritize applying available patches to mitigate the risks associated with this vulnerability. For detailed guidance, refer to the vendor's advisory.

Affected Version(s)

Security QRadar EDR 3.12.0 <= 3.12.26

References

https://www.ibm.com/support/pages/node/7296309
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.