CVE-2026-12354
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application. An authenticated attacker could execute arbitrary code on the application server.
Risk Assessment
An attacker with valid credentials could take control of the application server and execute malicious code. The risk includes full compromise of system integrity and confidentiality.
Recommendation
Update IBM MQ to the latest patched version. Restrict access to the verification application and enforce strict JNDI name validation.
Other vulnerabilities in IBM MQ
See all- CVE-2026-12351Critical
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
- CVE-2026-18142High
IBM MQ LTS and CD versions contain an integer overflow that could be exploited by a remote authenticated attacker. This may result in a denial of service and limited memory corruption.
- CVE-2026-14252Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.
- CVE-2026-13292High
IBM MQ LTS and CD versions allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. The vulnerability affects the message transfer mechanism.
- CVE-2026-13289High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-13284High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-12550Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.
- CVE-2026-12538Medium
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
- CVE-2026-12356High
IBM MQ LTS and CD versions allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands. The vulnerability affects command queue processing.
- CVE-2026-11724High
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Original NVD description (English source)
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS