CVE-2026-11375: IBM MQ queue manager is vulnerable to remote code execution

Q: Can an unauthenticated remote user exploit this issue?

The reported attack requires authentication. The available information does not indicate that unauthenticated users can exploit it.

Q: What outcomes are possible if the flaw is exploited?

An authenticated attacker may cause a denial of service or potentially execute arbitrary code. The reported impact includes compromise of confidentiality, integrity, and availability.

Published Sep 14, 2026

Updated

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.

Affected Software

7 affected components

IBM MQ<=9.1.0.0 to 9.1.0.37 LTS

IBM MQ<=9.2.0.0 to 9.2.0.43 LTS

IBM MQ<=9.3.0.0 to 9.3.0.41 LTS

IBM MQ<=9.3.0.0 to 9.3.5.1 CD

IBM MQ<=9.4.0.0 to 9.4.0.25 LTS

IBM MQ<=9.4.0.0 to 9.4.5.1 CD

IBM MQ<=10.0.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM MQ 9.1 LTS to a version that resolves this vulnerability.
Fixed in 9.1.0.38
Upgrade
Upgrade IBM MQ 9.2 LTS to a version that resolves this vulnerability.
Fixed in 9.2.0.44
Upgrade
Upgrade IBM MQ 9.3 LTS to a version that resolves this vulnerability.
Fixed in 9.3.0.42
Upgrade
Upgrade IBM MQ 9.4 LTS to a version that resolves this vulnerability.
Fixed in 9.4.0.26
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 10.0.0.5Patch DT473424

Event History

Sep 14, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Sep 18, 2026

CVE Published

via MITRE·04:09 PM

Data Sourced

via MITRE·04:09 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7284948

Frequently Asked Questions

Can an unauthenticated remote user exploit this issue?