CVE-2026-10859: IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.
Other sources
IBM MQ XMS .NET client could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.2.0.46 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.3.0.43 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.4.0.30 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.0.6 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.1.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be authenticated and able to supply a malicious ObjectMessage payload that is processed by a consumer application using the IBM MQ XMS .NET client. Exploitation also has high attack complexity.
Which deployments are affected?
Affected releases include IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 in both LTS and CD releases. The exposed component is the XMS .NET client on consumer applications.
What is the potential impact on a vulnerable consumer application?
A successful exploit can allow arbitrary code execution on the consumer application. The reported impact includes high confidentiality, integrity, and availability impact.