CVE-2026-11376: IBM MQ is affected by a denial of service vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker must be authenticated and able to submit subscription requests to an affected IBM MQ instance. No user interaction is required, and the attack can be performed over the network.

Q: Which deployments should be prioritized for remediation?

Prioritize IBM MQ deployments running the listed affected LTS or CD version ranges where authenticated users or applications can create subscription requests. The issue has high confidentiality, integrity, and availability impact if exploited.

Q: What is the potential impact beyond service disruption?

A crafted subscription request containing buffer size values that trigger the integer overflow can cause denial of service and may potentially allow arbitrary code execution.

Published Oct 29, 2026

Updated

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.

Other sources

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.

— IBM

Affected Software

5 affected components

IBM MQ<=9.2.0.0 to 9.2.0.44 LTS

IBM MQ<=9.3.0.0 to 9.3.0.42 LTS

IBM MQ<=9.4.0.0 to 9.4.0.26 LTS

IBM MQ<=9.4.0.0 to 9.4.5.1 CD

IBM MQ<=10.0.0.0 to 10.0.0.5 LTS and CD

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 9.2.0.46
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 9.3.0.43
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 9.4.0.30
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 10.0.0.6
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 10.0.1.0

Event History

Oct 29, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 4, 2026

CVE Published

via MITRE·08:26 PM

Data Sourced

via MITRE·08:26 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294498

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated and able to submit subscription requests to an affected IBM MQ instance. No user interaction is required, and the attack can be performed over the network.

Which deployments should be prioritized for remediation?

Prioritize IBM MQ deployments running the listed affected LTS or CD version ranges where authenticated users or applications can create subscription requests. The issue has high confidentiality, integrity, and availability impact if exploited.

What is the potential impact beyond service disruption?

A crafted subscription request containing buffer size values that trigger the integer overflow can cause denial of service and may potentially allow arbitrary code execution.

CVE-2026-11376: IBM MQ is affected by a denial of service vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments should be prioritized for remediation?

What is the potential impact beyond service disruption?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments should be prioritized for remediation?

What is the potential impact beyond service disruption?