CVE-2026-11725: IBM MQ queue manager is vulnerable to privilege escalation

Q: Can this be exploited remotely without user interaction?

The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required. The attacker must already be authenticated.

Q: How much access does an attacker need before attempting exploitation?

The CVSS vector lists low privileges required, indicating that an authenticated account with limited privileges may be sufficient.

Published Sep 14, 2026

Updated

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

Affected Software

7 affected components

IBM MQ<=9.1.0.0 to 9.1.0.37 LTS

IBM MQ<=9.2.0.0 to 9.2.0.43 LTS

IBM MQ<=9.3.0.0 to 9.3.0.41 LTS

IBM MQ<=9.3.0.0 to 9.3.5.1 CD

IBM MQ<=9.4.0.0 to 9.4.0.25 LTS

IBM MQ<=9.4.0.0 to 9.4.5.1 CD

IBM MQ<=10.0.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM MQ 9.1 LTS to a version that resolves this vulnerability.
Fixed in 9.1.0.38
Upgrade
Upgrade IBM MQ 9.2 LTS to a version that resolves this vulnerability.
Fixed in 9.2.0.44
Upgrade
Upgrade IBM MQ 9.3 LTS to a version that resolves this vulnerability.
Fixed in 9.3.0.42
Upgrade
Upgrade IBM MQ 9.4 LTS to a version that resolves this vulnerability.
Fixed in 9.4.0.26
Upgrade
Upgrade IBM MQ 10.0 to a version that resolves this vulnerability.
Fixed in 10.0.0.5Patch DT473418

Event History

Sep 14, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Sep 18, 2026

CVE Published

via MITRE·07:15 PM

Data Sourced

via MITRE·07:15 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7284944

Frequently Asked Questions

Can this be exploited remotely without user interaction?

The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required. The attacker must already be authenticated.

How much access does an attacker need before attempting exploitation?

The CVSS vector lists low privileges required, indicating that an authenticated account with limited privileges may be sufficient.

CVE-2026-11725: IBM MQ queue manager is vulnerable to privilege escalation

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Can this be exploited remotely without user interaction?

How much access does an attacker need before attempting exploitation?

Company

Resources

Contact