CVE-2025-36379
📋 TL;DR
IBM Security QRadar EDR and ReaQta use weak cryptographic algorithms that could allow attackers to decrypt sensitive information. This affects organizations using IBM Security QRadar EDR versions 3.12 through 3.12.23 and IBM Security ReaQta.
💻 Affected Systems
- IBM Security QRadar EDR
- IBM Security ReaQta
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers decrypt highly sensitive security data, including threat intelligence, endpoint telemetry, or configuration secrets, potentially compromising the entire security monitoring infrastructure.
Likely Case
Attackers with network access decrypt intercepted communications or stored data to gain insights into security posture, evade detection, or extract credentials.
If Mitigated
With proper network segmentation and encryption controls, attackers cannot access encrypted data streams, limiting impact to theoretical risk.
🎯 Exploit Status
Exploitation requires access to encrypted data and cryptographic analysis capabilities. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fix per IBM Security Advisory 7260390
Vendor Advisory: https://www.ibm.com/support/pages/node/7260390
Restart Required: Yes
Instructions:
1. Review IBM Security Advisory 7260390. 2. Apply the recommended fix/update from IBM. 3. Restart affected services. 4. Verify cryptographic algorithms have been strengthened.
🔧 Temporary Workarounds
Network Segmentation
allIsolate QRadar EDR/ReaQta systems from untrusted networks to prevent data interception.
Encryption Layer
allImplement additional encryption (e.g., VPN, TLS) for network communications to protect data in transit.
🧯 If You Can't Patch
- Isolate affected systems in a dedicated security VLAN with strict access controls.
- Monitor network traffic to/from affected systems for unusual decryption attempts or data exfiltration.
🔍 How to Verify
Check if Vulnerable:
Check IBM Security QRadar EDR/ReaQta version. If version is between 3.12 and 3.12.23 inclusive, system is vulnerable.Check Version:
Check via IBM QRadar EDR/ReaQta administration interface or consult IBM documentation for version query commands.Verify Fix Applied:
Verify version is updated beyond 3.12.23 and confirm cryptographic settings use strong algorithms (e.g., AES-256, SHA-256).📡 Detection & Monitoring
Log Indicators:
- Unusual cryptographic operations or errors in application logs
- Failed decryption attempts or cryptographic protocol violations
Network Indicators:
- Unusual traffic patterns to/from QRadar EDR/ReaQta systems
- Suspicious decryption-related network activity
SIEM Query:
source="qradar_edr" OR source="reaqta" AND (event_type="crypto_error" OR event_type="decryption_failure")