CVE-2026-12351
CriticalCVSS 9.8Summary
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
Risk Assessment
A remote attacker can execute arbitrary code in the context of the IBM MQ server, potentially leading to full compromise of the messaging system and access to transmitted data.
Recommendation
Upgrade IBM MQ to the latest patched version. If the IVT application is not used, consider removing or disabling it.
Other vulnerabilities in IBM MQ
See all- CVE-2026-13265Medium
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.
- CVE-2026-13293High
IBM MQ versions LTS and CD up to 10.0.0.0 allow a remote authenticated attacker to execute arbitrary code on the system due to deserialization of untrusted data.
- CVE-2026-13287High
IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.
- CVE-2026-13285High
IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.
- CVE-2026-13275High
IBM MQ Managed File Transfer versions LTS and CD up to 10.0.0.0 allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.
Original NVD description (English source)
IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.