CVE-2026-12356: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker must be authenticated and have access to the relevant command queue. Exploitation involves injecting malicious arguments into Ant script commands.

Q: Which deployments should be prioritized for remediation?

Prioritize IBM MQ Managed File Transfer deployments in the listed affected 9.2, 9.3, 9.4, and 10.0 release ranges where authenticated users have command queue access. Successful exploitation can result in arbitrary code execution with impacts to confidentiality, integrity, and availability.

Q: Is unauthenticated remote exploitation indicated?

No. The supplied vector requires low privileges and does not require user interaction, but it also requires an authenticated user with command queue access.

Published Oct 29, 2026

Updated

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.

Other sources

IBM MQ Managed File Transfer could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.

— IBM

Affected Software

5 affected components

IBM MQ<=9.2.0.0 to 9.2.0.44 LTS

IBM MQ<=9.3.0.0 to 9.3.0.42 LTS

IBM MQ<=9.4.0.0 to 9.4.0.26 LTS

IBM MQ<=9.4.0.0 to 9.4.5.1 CD

IBM MQ<=10.0.0.0 to 10.0.0.5 LTS and CD

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM MQ 9.2 LTS to a version that resolves this vulnerability.
Fixed in 9.2.0.46
Upgrade
Upgrade IBM MQ 9.3 LTS to a version that resolves this vulnerability.
Fixed in 9.3.0.43
Upgrade
Upgrade IBM MQ 9.4 to a version that resolves this vulnerability.
Fixed in 9.4.0.30
Upgrade
Upgrade IBM MQ 10.0 to a version that resolves this vulnerability.
Fixed in 10.0.0.6
Upgrade
Upgrade IBM MQ 10.0 to a version that resolves this vulnerability.
Fixed in 10.0.1.0

Event History

Oct 29, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 4, 2026

CVE Published

via MITRE·08:25 PM

Data Sourced

via MITRE·08:25 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:18 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294642

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated and have access to the relevant command queue. Exploitation involves injecting malicious arguments into Ant script commands.

Which deployments should be prioritized for remediation?

Prioritize IBM MQ Managed File Transfer deployments in the listed affected 9.2, 9.3, 9.4, and 10.0 release ranges where authenticated users have command queue access. Successful exploitation can result in arbitrary code execution with impacts to confidentiality, integrity, and availability.

Is unauthenticated remote exploitation indicated?

No. The supplied vector requires low privileges and does not require user interaction, but it also requires an authenticated user with command queue access.

CVE-2026-12356: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments should be prioritized for remediation?

Is unauthenticated remote exploitation indicated?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments should be prioritized for remediation?

Is unauthenticated remote exploitation indicated?