CVE-2025-33120 IBM QRadar SIEM privilege escalation
An authenticated user can escalate privileges in IBM QRadar SIEM due to a misconfigured cronjob running with unnecessary privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-33120?
CVE-2025-33120 is a high-severity vulnerability in Ibm Qradar Security Information and Event Manager, published on 22 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges.
Weakness: CWE-250
Which versions are affected by CVE-2025-33120?
It affects 2 products.
Products include Ibm Qradar Incident Forensics, Ibm Qradar Security Information and Event Manager.
How do I fix CVE-2025-33120?
No fix has been published for CVE-2025-33120 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-33120 being exploited?
There is no known exploitation of CVE-2025-33120 in the wild and no public exploit code.
Other vulnerabilities in Ibm Qradar Security Information and Event Manager
- CVE-2016-9726 Command injection in IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7, 7.1 MR2, 7.2.3
- CVE-2016-9727 Command injection in QRadar SIEM
- CVE-2018-1649 Path traversal in QRadar Incident Forensics
- CVE-2018-1648 Weak cryptography in n/a
- CVE-2018-1647 Denial of service in QRadar Incident Forensics
All Ibm Qradar Security Information and Event Manager vulnerabilities
Sources
Also known as GHSA-67f9-x324-v6v2.