High · 7.5 CVE-2026-10859 EUVD-2026-117076GHSA-6fmg-55h8-722v

IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability

Published Nov 4, 2026 · Updated Nov 12, 2026 · Assigned by ibm

Description

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.

Affected products

Vendor	Product	Affected	Fixed
IBM	MQ	9.2.0.0 – ≤ 9.2.0.44, 9.3.0.0 – ≤ 9.3.0.42, 9.4.0.0 – ≤ 9.4.0.26, 9.4.0.0 – ≤ 9.4.5.1, 10.0.0.0 – ≤ 10.0.0.5	—

Advisories 1

WID-SEC-2026-4343 IBM MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026

References

https://www.ibm.com/support/pages/node/7294664 vendor-advisory patch