Ibm Mq vulnerabilities
109 known vulnerabilities affecting ibm/mq.
Total CVEs
109
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH44MEDIUM58LOW3
Vulnerabilities
Page 1 of 6
CVE-2026-13293P2HIGHCVSS 8.8≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-14
CVE-2026-13293 [HIGH] CWE-502 CVE-2026-13293: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
nvd
CVE-2020-4682P2CRITICALCVSS 9.8v8.0.0.0v8.0.0.1+39 more2021-01-28
CVE-2020-4682 [CRITICAL] CWE-502 CVE-2020-4682: IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary co
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.
nvd
CVE-2026-12351P2CRITICALCVSS 9.8≥ 9.3.0.0, ≤ 9.3.0.41 LTS≥ 9.4.0.0, ≤ 9.4.0.25 LTS+1 more2026-09-15
CVE-2026-12351 [CRITICAL] CWE-74 CVE-2026-12351: IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0
IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
nvd
CVE-2026-12728P2HIGHCVSS 8.8≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-15
CVE-2026-12728 [HIGH] CWE-502 CVE-2026-12728: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted data.
nvd
CVE-2026-10027P3CRITICALCVSS 9.8≥ 9.1.0.0, ≤ 9.1.0.37≥ 9.2.0.0, ≤ 9.2.0.43+5 more2026-09-18
CVE-2026-10027 [CRITICAL] CWE-787 CVE-2026-10027: IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a
IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.
nvd
CVE-2026-11729P3HIGHCVSS 8.5≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-15
CVE-2026-11729 [HIGH] CWE-502 CVE-2026-11729: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code in client applications due to unsafe deserialization that enables JNDI injection attacks.
nvd
CVE-2026-11725P3HIGHCVSS 8.8≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-18
CVE-2026-11725 [HIGH] CWE-190 CVE-2026-11725: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arb
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.
nvd
CVE-2026-10751P3HIGHCVSS 7.5≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-18
CVE-2026-10751 [HIGH] CWE-502 CVE-2026-10751: IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code
IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.
nvd
CVE-2026-10853P3HIGHCVSS 8.8≥ 9.1.0.0, ≤ 9.1.0.37≥ 9.2.0.0, ≤ 9.2.0.43+5 more2026-09-18
CVE-2026-10853 [HIGH] CWE-470 CVE-2026-10853: IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or pot
IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
nvd
CVE-2026-12355P3HIGHCVSS 8.1≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-15
CVE-2026-12355 [HIGH] CWE-74 CVE-2026-12355: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code e
nvd
CVE-2022-22489P3CRITICALCVSS 9.1v8.0.0.0v9.0.0.0+8 more2022-08-19
CVE-2022-22489 [CRITICAL] CWE-611 CVE-2022-22489: IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injec
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339.
nvd
CVE-2026-11378P3HIGHCVSS 8.8≥ 9.1.0.0, ≤ 9.1.0.37≥ 9.2.0.0, ≤ 9.2.0.43+5 more2026-09-18
CVE-2026-11378 [HIGH] CWE-190 CVE-2026-11378: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arb
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.
nvd
CVE-2026-11375P3HIGHCVSS 8.8≥ 9.1.0.0, ≤ 9.1.0.37≥ 9.2.0.0, ≤ 9.2.0.43+5 more2026-09-18
CVE-2026-11375 [HIGH] CWE-122 CVE-2026-11375: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arb
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.
nvd
CVE-2024-40681P3HIGHCVSS 8.8v9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD2024-09-07
CVE-2024-40681 [HIGH] CWE-266 CVE-2024-40681: IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.
nvd
CVE-2026-10575P3HIGHCVSS 8.8≥ 9.1.0.0, ≤ 9.1.0.37≥ 9.2.0.0, ≤ 9.2.0.43+5 more2026-09-18
CVE-2026-10575 [HIGH] CWE-122 CVE-2026-10575: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate pr
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.
nvd
CVE-2026-12354P3HIGHCVSS 7.5≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-15
CVE-2026-12354 [HIGH] CWE-913 CVE-2026-12354: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to improper validation of JNDI names in the Resource Adapter In
nvd
CVE-2025-0975P3HIGHCVSS 8.8v9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD2025-02-28
CVE-2025-0975 [HIGH] CWE-150 CVE-2025-0975: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute cod
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.
nvd
CVE-2024-31912P3HIGHCVSS 8.8v9.3.0v9.3 LTS and 9.3 CD2024-06-28
CVE-2024-31912 [HIGH] CWE-266 CVE-2024-31912: IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certa
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. IBM X-Force ID: 289894.
nvd
CVE-2026-11728P3HIGHCVSS 8.1≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-15
CVE-2026-11728 [HIGH] CWE-787 CVE-2026-11728: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving m
nvd
CVE-2026-12666P3HIGHCVSS 8.1≥ 9.1.0.0, ≤ 9.1.0.37 LTS≥ 9.2.0.0, ≤ 9.2.0.43 LTS+3 more2026-09-15
CVE-2026-12666 [HIGH] CWE-611 CVE-2026-12666: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in M
nvd
1 / 6Next →