Skip to content
OpenAdvisories
High WID-SEC-2026-3409 19 CVEs

IBM MQ: Mehrere Schwachstellen

Published Sep 15, 2026 · Updated Sep 22, 2026 · Revision 3 · de-DE

Vendor: IBM Product: MQ Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

IBM MQ ist eine Message Oriented Middleware von IBM.

Vulnerabilities 19

  • Critical 10.0
    CVE-2026-10747

    IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing

    IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.

    IBM MQ Appliance
  • Critical 9.9
    CVE-2026-10858

    IBM MQ for HPE NonStop is vulnerable to a denial of service attack

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.

    IBM MQ for HPE NonStop
  • Critical 9.8
    CVE-2026-12351

    IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection

    IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is d…

    IBM MQ
  • High 8.8
    CVE-2026-11725

    IBM MQ queue manager is vulnerable to privilege escalation

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

    IBM MQ
  • High 8.8
    CVE-2026-12728

    IBM MQ Java messaging is vulnerable to remote code execution

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code…

    IBM MQ
  • High 8.5
    CVE-2026-11729

    IBM MQ Java messaging is vulnerable to remote code execution

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code…

    IBM MQ
  • High 8.1
    CVE-2026-10027

    IBM MQ queue manager is vulnerable to unauthenticated remote code execution

    IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.

    IBM MQ
  • High 8.1
    CVE-2026-11727

    IBM MQ for HPE NonStop is vulnerable to a denial of service issue

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

    IBM MQ for HPE NonStop
  • High 8.1
    CVE-2026-11728

    IBM MQ .NET client is vulnerable to remote code execution

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or p…

    IBM MQ
  • High 8.1
    CVE-2026-12355

    IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due t…

    IBM MQ
  • High 8.1
    CVE-2026-12666

    IBM MQ Java messaging is vulnerable to XML external entity injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtai…

    IBM MQ
  • High 7.5
    CVE-2026-10744

    IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validation

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer overflow in MQINQ request validation.

    IBM MQ for HPE NonStop
  • High 7.5
    CVE-2026-10751

    IBM MQ Java messaging is vulnerable to remote code execution

    IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.

    IBM MQ
  • High 7.5
    CVE-2026-10853

    IBM MQ queue manager is vulnerable to remote code execution

    IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

    IBM MQ
  • High 7.5
    CVE-2026-11716

    IBM MQ for HPE NonStop is vulnerable to a denial of service attack

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

    IBM MQ for HPE NonStop
  • High 7.5
    CVE-2026-12354

    IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code…

    IBM MQ
  • High 7.1
    CVE-2026-10030

    IBM MQ Console is vulnerable to privilege escalation

    IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.

    IBM MQ
  • High 7.1
    CVE-2026-12667

    IBM MQ .NET client is vulnerable to XML external entity injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vuln…

    IBM MQ
  • High 7.0
    CVE-2026-12150

    IBM MQ queue manager is vulnerable to denial of service

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certifi…

    IBM MQ

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-83034, EUVD-2026-83032, EUVD-2026-83021, EUVD-2026-83016, EUVD-2026-83131, EUVD-2026-83129, EUVD-2026-83018, EUVD-2026-83294, EUVD-2026-83292, EUVD-2026-83289

  3. #1

    Initiale Fassung

References