CVE-2026-11381: IBM MQ for HPE NonStop is vulnerable to a denial of service issue
Published Sep 17, 2026
·Updated
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.
Affected Software
1 affected component
IBM MQ for HPE NonStop<=8.1.0 - 8.1.0.40
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQ V8.1 for HPE NonStopto a version that resolves this vulnerability.Fixed in 8.1.0.41Patch IT49925
Event History
Sep 17, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 18, 2026
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated and able to reach the affected IBM MQ for HPE NonStop instance over the network. No user interaction is required.
2
What impact should responders plan for?
A successful attack can cause a denial of service. The available information also states that arbitrary code execution may be possible, but does not establish it as guaranteed.