CVE-2026-12356
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
IBM MQ LTS and CD versions allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands. The vulnerability affects command queue processing.
Risk Assessment
A user with command queue access could execute arbitrary commands with IBM MQ service privileges, potentially leading to system compromise.
Recommendation
Update IBM MQ to the latest patched version and restrict command queue access to only necessary, trusted accounts.
Other vulnerabilities in IBM MQ
See all- CVE-2026-12351Critical
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
- CVE-2026-18142High
IBM MQ LTS and CD versions contain an integer overflow that could be exploited by a remote authenticated attacker. This may result in a denial of service and limited memory corruption.
- CVE-2026-14252Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.
- CVE-2026-13292High
IBM MQ LTS and CD versions allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. The vulnerability affects the message transfer mechanism.
- CVE-2026-13289High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-13284High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-12550Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.
- CVE-2026-12538Medium
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
- CVE-2026-11724High
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
- CVE-2026-11376High
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
Original NVD description (English source)
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS