CVE-2025-36376 IBM Security QRadar EDR Software has multiple vulnerabilities

What is CVE-2025-36376?

CVE-2025-36376 is a medium-severity authentication bypass vulnerability in IBM Security QRadar EDR, published on 17 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user to impersonate another user on the system.

Weakness: CWE-613

Which versions are affected by CVE-2025-36376?

It affects 1 product.

Products include Ibm Security Qradar Edr.

How do I fix CVE-2025-36376?

No fix has been published for CVE-2025-36376 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-36376 being exploited?

There is no known exploitation of CVE-2025-36376 in the wild and no public exploit code.

Other vulnerabilities in IBM Security QRadar EDR

• CVE-2023-33861 IBM Security ReaQta improper certificate validation Medium 6.5
• CVE-2024-45641 IBM Security ReaQta improper certificate validation Medium 6.5
• CVE-2024-45643 IBM QRadar EDR information disclosure Medium 5.9
• CVE-2023-35006 IBM Security ReaQta HTML injection Medium 5.4
• CVE-2024-45640 IBM Security QRadar EDR information disclosure Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cxcr-rj95-h6f4.