CVE-2026-11728: IBM MQ .NET client is vulnerable to remote code execution
IBM MQ .NET Client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving messages from a malicious queue manager or through a man-in-the-middle attack.
Other sources
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving messages from a malicious queue manager or through a man-in-the-middle attack.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQ .NET Clientto a version that resolves this vulnerability.Fixed in 9.1.0.38 - Upgrade
Upgrade
IBM MQ .NET Clientto a version that resolves this vulnerability.Fixed in 9.2.0.44 - Upgrade
Upgrade
IBM MQ .NET Clientto a version that resolves this vulnerability.Fixed in 9.3.0.42 - Upgrade
Upgrade
IBM MQ .NET Clientto a version that resolves this vulnerability.Fixed in 9.4.0.26 - Upgrade
Upgrade
IBM MQ .NET Clientto a version that resolves this vulnerability.Fixed in 10.0.0.5 - Compensating control
If applicable and before the upgrade, mitigate exposure by preventing connections to untrusted/malicious queue managers and avoiding man-in-the-middle risk (e.g., ensure secure client/queue manager communication).
- Operational
After upgrading IBM MQ .NET Client (and related IBM MQ components as needed), restart affected client applications to ensure the updated client libraries are in use.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the IBM MQ .NET Client in the listed IBM MQ 9.1, 9.2, 9.3, 9.4, or 10.0.0.0 versions are exposed when the client receives messages from a malicious queue manager or an attacker can perform a man-in-the-middle attack.
What does an attacker need to exploit the vulnerability?
An attacker must be able to send malicious messages through a malicious queue manager or intercept and modify traffic between the client and queue manager. No privileges or user interaction are required according to the supplied severity vector.
What is the potential impact on an affected client?
Successful exploitation may cause a denial of service or potentially allow arbitrary code execution on the system running the IBM MQ .NET Client.