MQ vulnerabilities

40 known vulnerabilities in MQ from IBM. 40 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  MQ: Integer Overflow or Wraparound

  CVE-2026-18142Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited m

• 8.8 High severity

  MQ: External Control of System or Configuration Setting

  CVE-2026-13292Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environ

• 7.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-13289Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A rem

• 7.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-13284Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A rem

• 8.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-13271Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or

• 7.5 High severity

  MQ: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-12356Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injec

• 8.8 High severity

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26…

  CVE-2026-11724Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer age

• 8.8 High severity

  MQ: Integer Overflow or Wraparound

  CVE-2026-11376Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbi

• 8.8 High severity

  MQ: Deserialization of Untrusted Data

  CVE-2026-10859Nov 4, 2026IBM

  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due t

• 8.8 High severity

  MQ: Integer Overflow or Wraparound

  CVE-2026-11725Sep 18, 2026IBM

  IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

• 8.8 High severity

  MQ: Integer Overflow or Wraparound

  CVE-2026-11378Sep 18, 2026IBM

  IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.

• 8.8 High severity

  MQ: Heap-based Buffer Overflow

  CVE-2026-11375Sep 18, 2026IBM

  IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.

• 8.8 High severity

  MQ: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2026-10853Sep 18, 2026IBM

  IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

• 7.5 High severity

  MQ: Deserialization of Untrusted Data

  CVE-2026-10751Sep 18, 2026IBM

  IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.

• 8.8 High severity

  MQ: Heap-based Buffer Overflow

  CVE-2026-10575Sep 18, 2026IBM

  IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.

• 9.8 Critical severity

  MQ: Out-of-bounds Write

  CVE-2026-10027Sep 18, 2026IBM

  IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.

• 8.8 High severity

  MQ: Deserialization of Untrusted Data

  CVE-2026-12728Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code

• 7.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-12667Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulne

• 8.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-12666Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain

• 8.1 High severity

  MQ: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-12355Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to

• 7.5 High severity

  MQ: Improper Control of Dynamically-Managed Code Resources

  CVE-2026-12354Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code

• 9.8 Critical severity

  MQ: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-12351Sep 15, 2026IBM

  IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is de

• 7.0 High severity

  MQ: Stack-based Buffer Overflow

  CVE-2026-12150Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certific

• 8.5 High severity

  MQ: Deserialization of Untrusted Data

  CVE-2026-11729Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code

• 8.1 High severity

  MQ: Out-of-bounds Write

  CVE-2026-11728Sep 15, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or po

• 8.8 High severity

  MQ: Deserialization of Untrusted Data

  CVE-2026-13293Sep 14, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrary

• 7.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-13287Sep 14, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack w

• 7.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-13285Sep 14, 2026IBM

  IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

• 7.1 High severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2026-13275Sep 14, 2026IBM

  IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to r

• 7.5 High severity

  MQ: Missing Release of Resource after Effective Lifetime

  CVE-2025-36128Oct 16, 2025IBM

  IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a

• 8.8 High severity

  MQ: Improper Neutralization of Escape, Meta, or Control Sequences

  CVE-2025-0975Feb 28, 2025IBM

  IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.

• 8.8 High severity

  MQ: Incorrect Privilege Assignment

  CVE-2024-40681Sep 7, 2024IBM

  IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.

• 7.5 High severity

  MQ: Allocation of Resources Without Limits or Throttling

  CVE-2024-35116Jun 28, 2024IBM

  IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. IBM X-Force ID: 290335.

• 7.5 High severity

  MQ: Allocation of Resources Without Limits or Throttling

  CVE-2024-31919Jun 28, 2024IBM

  IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API Exit using MQBUFMH is used. IBM X-Force ID: 290259.

• 8.8 High severity

  MQ: Incorrect Privilege Assignment

  CVE-2024-31912Jun 28, 2024IBM

  IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. IBM X-Force ID: 289894.

• 7.5 High severity

  MQ: Insufficient Control of Network Message Volume (Network Amplification)

  CVE-2024-25015May 1, 2024IBM

  IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. IBM X-Force ID: 281278.

• 7.5 High severity

  IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote…

  CVE-2024-25016Mar 3, 2024IBM

  IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Force ID: 281279.

• 7.5 High severity

  IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS…

  CVE-2023-28513Jul 19, 2023IBM

  IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 250397.

• 7.5 High severity

  MQ: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2023-26285May 5, 2023IBM

  IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data. IBM X-Force ID: 248418.

• 9.1 Critical severity

  MQ: Improper Restriction of XML External Entity Reference

  CVE-2022-22489Aug 19, 2022IBMEPSS 1.76%

  IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM