Ibm Mq vulnerabilities

87 known vulnerabilities affecting ibm/mq.

Total CVEs

87

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL2HIGH26MEDIUM56LOW3

Vulnerabilities

Page 1 of 5

CVE-2026-1713MEDIUMCVSS 5.0≥ 9.1.0.0, < 9.1.0.34≥ 9.2.0.0, < 9.2.0.41+8 more2026-03-03

CVE-2026-1713 [MEDIUM] CWE-305 CVE-2026-1713: IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.3 IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD

CVE-2025-36128HIGHCVSS 7.5v9.1.0.0v9.2.0.0+8 more2025-10-16

CVE-2025-36128 [HIGH] CWE-772 CVE-2025-36128: IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improp IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2025-36100MEDIUMCVSS 5.5≥ 9.1.0.0, < 9.1.0.31≥ 9.2.0.0, < 9.2.0.37+7 more2025-09-07

CVE-2025-36100 [MEDIUM] CWE-260 CVE-2025-36100: IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.

CVE-2025-3631HIGHCVSS 7.5≥ 9.3.2.0 CD, ≤ 9.3.5.1 CD≥ 9.4.0.0, ≤ 9.4.2.1 CD+1 more2025-07-11

CVE-2025-3631 [MEDIUM] CWE-416 CVE-2025-3631: An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA c An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it.

CVE-2025-0975HIGHCVSS 8.8v9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD2025-02-28

CVE-2025-0975 [HIGH] CWE-150 CVE-2025-0975: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute cod IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.

CVE-2024-54175MEDIUMCVSS 5.5v9.3.0v9.4.0+1 more2025-02-28

CVE-2024-54175 [MEDIUM] CWE-754 CVE-2024-54175: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions.

CVE-2024-54173MEDIUMCVSS 4.7v9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD2025-02-28

CVE-2024-54173 [MEDIUM] CWE-1323 CVE-2024-54173: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.

CVE-2025-0985MEDIUMCVSS 5.5v9.3.0v9.4.0+1 more2025-02-28

CVE-2025-0985 [MEDIUM] CWE-526 CVE-2025-0985: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environmen IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user.

CVE-2025-23225MEDIUMCVSS 6.5v9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD2025-02-28

CVE-2025-23225 [MEDIUM] CWE-230 CVE-2025-23225: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to cause a denial of s IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to cause a denial of service due to the improper handling of invalid headers sent to the queue.

CVE-2024-52898MEDIUMCVSS 6.2≥ 9.3.0, ≤ 9.4.1.1≥ 9.3.0.0, ≤ 9.3.0.26+2 more2025-01-14

CVE-2024-52898 [MEDIUM] CWE-209 CVE-2024-52898: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned.

CVE-2024-52896MEDIUMCVSS 6.2≥ 9.2.0.0, < 9.2.0.30≥ 9.3.0, < 9.4.1.1+3 more2024-12-19

CVE-2024-52896 [MEDIUM] CWE-209 CVE-2024-52896: IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to ob IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.

CVE-2024-52897MEDIUMCVSS 6.2≥ 9.2.0.0, < 9.2.0.30≥ 9.3.0, < 9.4.1+3 more2024-12-19

CVE-2024-52897 [MEDIUM] CWE-209 CVE-2024-52897: IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to ob IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.

CVE-2024-51470MEDIUMCVSS 6.5v9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD2024-12-18

CVE-2024-51470 [MEDIUM] CWE-754 CVE-2024-51470: IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.

CVE-2024-40681HIGHCVSS 8.8v9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD2024-09-07

CVE-2024-40681 [HIGH] CWE-266 CVE-2024-40681: IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.

CVE-2024-40680MEDIUMCVSS 5.5v9.3 CD, 9.4 LTS, 9.4 CD2024-09-07

CVE-2024-40680 [MEDIUM] CWE-789 CVE-2024-40680: IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper m IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault.

CVE-2024-31912HIGHCVSS 8.8v9.3.0v9.3 LTS and 9.3 CD2024-06-28

CVE-2024-31912 [HIGH] CWE-266 CVE-2024-31912: IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certa IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. IBM X-Force ID: 289894.

CVE-2024-31919HIGHCVSS 7.5v9.0.0.0v9.1.0.0+3 more2024-06-28

CVE-2024-31919 [MEDIUM] CWE-770 CVE-2024-31919: IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API Exit using MQBUFMH is used. IBM X-Force ID: 290259.

CVE-2024-35116HIGHCVSS 7.5≥ 9.0.0.0, < 9.0.0.26≥ 9.1.0.0, < 9.1.0.22+4 more2024-06-28

CVE-2024-35116 [MEDIUM] CWE-789 CVE-2024-35116: IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack ca IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. IBM X-Force ID: 290335.

CVE-2024-35156MEDIUMCVSS 6.5≥ 9.3.0.0, < 9.3.0.20≥ 9.3.0.0, < 9.4.0.0+1 more2024-06-28

CVE-2024-35156 [MEDIUM] CWE-209 CVE-2024-35156: IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detai IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292766.

CVE-2024-35155MEDIUMCVSS 6.5v9.3.0v9.3 LTS and 9.3 CD2024-06-28

CVE-2024-35155 [MEDIUM] CWE-209 CVE-2024-35155: IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive i IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292765.