Where
-Infinity
0

Trending

Last week
Last month
Last year

Versions

9.3.0.0 to 9.3.5.1 cd
47
10.0.0.0
44
9.3.0.0 to 9.3.0.41 lts
44
9.4.0.0 to 9.4.0.25 lts
44
9.4.0.0 to 9.4.5.1 cd
42
9.1.0.0 to 9.1.0.37 lts
40
9.2.0.0 to 9.2.0.43 lts
40
9.1.0.0
11
8.1.0
10
sc2 (formerly lts): v3.2.0, v3.2.1cd:  v3.0.0, v3.0.1, v3.1.0 - 3.1.3 lts: v2.0.0 - 2.0.23 other release: v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2
8
8.0.4
7
9.2.0.0
7
9.3.0.0
7
9.4.0.0
7
9.3.5.1
6
9.1.0.37
5
9.2.0.43
5
9.3.0.41
5
9.4.0.25
5
9.4.5.1
5
sc2 (formerly lts): v3.2.0 - v3.2.8cd:  v3.0.0, v3.0.1, v3.1.0 - 3.1.3, v3.3.0, v3.4.0, v3.4.1 lts: v2.0.0 - 2.0.29 other release: v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2
5
2.0.0
4
2.2.0
4
2.2.2
4
2.3.0
4
2.3.3
4
2.4.0
4
3.0.0
4
3.0.1
4
8.0
3
8.0.0.0
3
9.0 lts
3
9.1 cd
3
9.1 lts
3
9.1.0
3
cd:  v3.0.0, v3.0.1, v3.1.0 - 3.1.3 lts: v2.0.0 - 2.0.22 other release: v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2
3
sc2 (formerly lts): v3.2.0 - v3.2.3cd:  v3.0.0, v3.0.1, v3.1.0 - 3.1.3 lts: v2.0.0 - 2.0.25 other release: v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2
3
sc2: v3.2.0 - v3.2.10cd:  v3.0.0, v3.0.1, v3.1.0 - 3.1.3, v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 lts: v2.0.0 - 2.0.29 other release: v2.4.0 - v2.4.8, v2.3.0 - 2.3.3, v2.2.0 - v2.2.2
3
2.0.18
2
2.4.7
2
2.4.8
2
3.1.0
2
3.1.3
2
3.2.0
2
9.0.0.0
2
9.1.0.0 to 9.1.0.33 lts
2
9.2 cd
2
9.2 lts
2
9.2.0
2
9.2.0.0 to 9.2.0.40 lts
2

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7287778

IBM MQ queue manager is vulnerable to remote code execution

Risk 79
Severity
8.8
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.

First published (updated )
CVE-2026-10575

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284896

IBM MQ Java messaging is vulnerable to remote code execution

Risk 79
Severity
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-13293

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284897

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

Risk 48
Severity
7.1
XEE
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-13275

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284937

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

Risk 48
Severity
7.1
XEE
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-13287

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284940

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

Risk 48
Severity
7.1
XEE
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-13285

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284895

IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection

Risk 52
Severity
6.8
XEE
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-13265

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284939

IBM MQ Java messaging is vulnerable to XML external entity injection

Risk 60
Severity
8.1
XEE
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-12666

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284912

IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution

Risk 75
Severity
8.1
Input Validation
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-12355

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284936

IBM MQ .NET client is vulnerable to XML external entity injection

Risk 48
Severity
7.1
XEE
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-12667

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284541

IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-12351

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284942

IBM MQ Java messaging is vulnerable to remote code execution

Risk 79
Severity
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted data.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-12728

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284908

IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

Risk 70
Severity
7.5
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-12354

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284911

IBM MQ queue manager is vulnerable to denial of service

Risk 55
Severity
7
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and potentially affect memory contents due to improper validation of deeply nested certificate data during TLS certificate processing.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-12150

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284941

IBM MQ Java messaging is vulnerable to remote code execution

Risk 73
Severity
8.5
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code in client applications due to unsafe deserialization that enables JNDI injection attacks.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-11729

IBM MQ1 vulnerability

First published (updated )
Advisory
IBM-7284943

IBM MQ .NET client is vulnerable to remote code execution

Risk 75
Severity
8.1
Buffer Overflow
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM MQ .NET Client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving messages from a malicious queue manager or through a man-in-the-middle attack.

1 / 2
Source: IBM
First published (updated )
CVE-2026-11728

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203