IBM MQ Appliance CVE-2026-10747

Exploitation requires only network reachability to the IBM MQ Appliance's protocol message listener - the overflow occurs in protocol message processing BEFORE authentication, so no credentials, session, or user interaction are needed (consistent with AV:N/AC:L/PR:N/UI:N). The primary limiting factor is network exposure: appliances deployed behind segmentation with the protocol port restricted to trusted hosts sharply reduce the attack surface. Reliable arbitrary code execution (versus a mere crash/DoS) is further limited by heap layout and any exploit-mitigation hardening on the appliance, which is why the vendor phrases RCE as 'potentially.' No non-default configuration is stated as required - the pre-auth parsing path is part of normal protocol handling.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes the worst realistic profile: network-reachable, low complexity, no privileges, no user interaction, and - critically - the flaw is in protocol message processing BEFORE authentication, so exposure begins at the listening socket. CWE-122 (heap buffer overflow) yielding potential arbitrary code execution on a network-facing messaging appliance is exactly the class attackers weaponize. Mitigating/tempering signals: no EPSS score, CISA KEV, or public POC was provided, so there is currently no public exploit identified and no confirmation of active exploitation - the 10.0 reflects theoretical worst-case impact, not proven in-the-wild activity. One point to verify: the vendor asserts S:C (scope change), which drives the score to a perfect 10.0; for a heap overflow contained within the appliance's own protocol-handling process, a scope-changed impact is defensible only if compromise crosses a security authority boundary (e.g., the appliance's management/hypervisor separation) - otherwise S:U (~9.8) is more consistent. Either way this remains critical. Bottom line: pre-auth network RCE potential on an enterprise appliance warrants emergency patching regardless of the missing exploitation telemetry.

A remote, unauthenticated attacker with network reachability to the IBM MQ Appliance's protocol listener sends a crafted protocol message that overflows a heap buffer during pre-authentication parsing, crashing the service (DoS) or potentially corrupting heap structures to achieve arbitrary code execution. Because the flaw triggers before authentication, no valid credentials, session, or user interaction are required. No public proof-of-concept exploit code was identified at the time of analysis.