CVE-2026-1276

Cross-site scripting (CWE-79) is when an attacker manages to sneak “bad instructions” (malicious JavaScript) into a website so that someone else’s browser runs it. In this case, a logged-in user with low privileges can inject code into the QRadar web interface, and that code could run inside another user’s active session—like slipping a counterfeit page into a trusted office binder so the next person reads and follows the attacker’s instructions.

This matters if your business uses IBM QRadar SIEM (the QRadar SIEM web interface) and you have any users who can log into it with low privileges. The attack requires the victim to be authenticated and to interact with a maliciously crafted page or input, so it’s mainly a risk where an attacker can obtain valid QRadar access and then target other users.
Reachability depends on whether attackers can reach the QRadar web interface in practice (for example, via the QRadar login and the users’ normal browser usage).

This is not a “scan the internet and get in” type bug: it needs a low-privileged authenticated user and then requires the victim to interact with a malicious input. Based on the available information, it has not been confirmed as exploited in the wild (not listed in CISA KEV and no public exploit code found), so the urgency is lower than actively exploited vulnerabilities—still, you should upgrade if you are in the affected version range.