CVE-2026-10859
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.
Risk Assessment
An authenticated attacker could execute arbitrary code on message-consuming applications, potentially leading to system compromise and data breach. However, valid credentials are required.
Recommendation
Update IBM MQ to the latest version containing the fix. Restrict trust in message sources and use secure deserialization mechanisms.
Other vulnerabilities in IBM MQ
See all- CVE-2026-12351Critical
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
- CVE-2026-18142High
IBM MQ LTS and CD versions contain an integer overflow that could be exploited by a remote authenticated attacker. This may result in a denial of service and limited memory corruption.
- CVE-2026-14252Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.
- CVE-2026-13292High
IBM MQ LTS and CD versions allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. The vulnerability affects the message transfer mechanism.
- CVE-2026-13289High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-13284High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-12550Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.
- CVE-2026-12538Medium
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
- CVE-2026-12356High
IBM MQ LTS and CD versions allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands. The vulnerability affects command queue processing.
- CVE-2026-11724High
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Original NVD description (English source)
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS