CVE-2026-12550: IBM MQ is affected by a denial of service vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.
Other sources
IBM MQ could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.2.0.46 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.3.0.43 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.4.0.30 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.0.6 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to IBM MQ and able to supply message selection parameters. The available data does not indicate that unauthenticated attackers can exploit it.
What security impact can exploitation have?
An authenticated attacker may obtain sensitive information or cause a denial of service. The CVSS vector indicates low confidentiality impact and low availability impact, with no integrity impact.
Which IBM MQ release lines are affected?
Affected releases include 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 in both LTS and CD.