CVE-2026-12728
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a deserialization of untrusted data vulnerability. An authenticated attacker could exploit it to execute arbitrary code.
Risk Assessment
An authenticated attacker can remotely execute arbitrary code in the context of the IBM MQ server, taking control of the messaging system and potentially accessing other organizational resources.
Recommendation
Upgrade IBM MQ to the latest version containing the security fix. Restrict access to the MQ server to trusted clients only.
Other vulnerabilities in IBM MQ
See all- CVE-2026-12351Critical
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
- CVE-2026-11727High
IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40, C client, could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.
- CVE-2026-11726High
IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.
- CVE-2026-11725High
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.
- CVE-2026-11716High
IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.
- CVE-2026-11381High
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.
- CVE-2026-11378High
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.
- CVE-2026-11375High
IBM MQ contains a stack buffer overflow when processing XA transaction identifiers. An authenticated attacker could exploit this to cause a denial of service or potentially execute arbitrary code.
- CVE-2026-10853High
IBM MQ improperly validates cluster command message lengths. An authenticated attacker with cluster access could cause a denial of service or potentially execute arbitrary code.
- CVE-2026-10575High
IBM MQ contains a heap buffer overflow when processing MQPUT operations with malformed distribution headers. An authenticated attacker could cause a denial of service or potentially escalate privileges.
Original NVD description (English source)
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS