CVE-2026-10853
published 2026-09-18CVE-2026-10853: IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation…
PriorityP351high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.37%
30.2th percentile
IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | mq | — | — |
| ibm | mq | 9.1.0.0 – 9.1.0.37 | — |
| ibm | mq | 9.2.0.0 – 9.2.0.43 | — |
| ibm | mq | 9.3.0.0 – 9.3.0.41 | — |
| ibm | mq | 9.3.0.0 – 9.3.5.1 | — |
| ibm | mq | 9.4.0.0 – 9.4.0.25 | — |
| ibm | mq | 9.4.0.0 – 9.4.5.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM MQ up to 10.0.0.0 externally-controlled input to select classes or code
vuldb·2026-09-21·CVSS 7.5
CVE-2026-10853 [HIGH] IBM MQ up to 10.0.0.0 externally-controlled input to select classes or code
A vulnerability has been found in IBM MQ up to 10.0.0.0 and classified as very critical. Impacted is an unknown function. This manipulation causes use of externally-controlled input to select classes or code.
The identification of this vulnerability is CVE-2026-10853. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
ghsa_unreviewed·2026-09-18
CVE-2026-10853 [HIGH] CWE-470 IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-18
Published