CVE-2026-10027: IBM MQ queue manager is vulnerable to unauthenticated remote code execution
IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.1.0.38 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.2.0.44 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.3.0.42 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.4.0.26 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.0.5
Event History
Frequently Asked Questions
Which IBM MQ deployments are exposed?
Exposure is limited to queue manager channels configured with compression enabled. The issue is triggered while processing malformed compressed data on those channels.
What does an attacker need to exploit this issue?
An attacker needs network access to reach an affected channel and send malformed compressed data. Authentication and user interaction are not required, although the attack complexity is rated high.