CVE-2026-11381
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.
Risk Assessment
An attacker can disrupt service or gain control of the system, potentially compromising availability and integrity of message processing.
Recommendation
Apply patches provided by IBM for IBM MQ. Restrict system access to trusted users only and monitor logs for unusual activity.
Other vulnerabilities in IBM MQ
See all- CVE-2026-12351Critical
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
- CVE-2026-18142High
IBM MQ LTS and CD versions contain an integer overflow that could be exploited by a remote authenticated attacker. This may result in a denial of service and limited memory corruption.
- CVE-2026-14252Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.
- CVE-2026-13292High
IBM MQ LTS and CD versions allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. The vulnerability affects the message transfer mechanism.
- CVE-2026-13289High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-13284High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-12550Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.
- CVE-2026-12538Medium
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
- CVE-2026-12356High
IBM MQ LTS and CD versions allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands. The vulnerability affects command queue processing.
- CVE-2026-11724High
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Original NVD description (English source)
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS