High · 7.5 CVE-2026-12354 EUVD-2026-78878GHSA-f7xx-g8p6-mpfr

IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

Published Sep 15, 2026 · Updated Sep 16, 2026 · Assigned by ibm

Description

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application.

Affected products

Vendor	Product	Affected	Fixed
IBM	MQ	9.1.0.0 – ≤ 9.1.0.37 LTS, 9.2.0.0 – ≤ 9.2.0.43 LTS, 9.3.0.0 – ≤ 9.3.0.41 LTS, 9.3.0.0 – ≤ 9.3.5.1 CD, 9.4.0.0 – ≤ 9.4.0.25 LTS, 9.4.0.0 – ≤ 9.4.5.1 CD, 10.0.0.0	—

Advisories 1

WID-SEC-2026-3409 IBM MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 22, 2026

References

https://www.ibm.com/support/pages/node/7284908 vendor-advisory patch