CVE-2026-18142: IBM MQ is affected by a denial of service vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.
Other sources
IBM MQ for z/OS could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.2.0.46 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.3.0.43 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.4.0.30 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.0.6 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.1.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker must be remotely authenticated. The provided data does not indicate that unauthenticated attackers can exploit it.
Which IBM MQ release lines are affected?
Affected releases include IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 in both LTS and CD. IBM MQ for z/OS is also affected, although the provided data does not specify z/OS version ranges.
What is the likely impact of successful exploitation?
Successful exploitation can cause a denial of service and limited memory corruption. The supplied severity vector indicates availability impact is high and integrity impact is low, with no confidentiality impact stated.