IBM MQ for HPE NonStop CVE-2026-11716

Requires an authenticated attacker (PR:L) with the ability to supply cluster migration data to a target IBM MQ for HPE NonStop queue manager running an affected version (8.1.0 through 8.1.0.40). The flaw is triggered specifically during queue manager startup when improperly validated cluster migration data is processed, so exploitation depends on the queue manager (re)starting and on the target participating in MQ clustering/migration. Limiting factors: authenticated cluster membership is needed, the condition is high-complexity (AC:H - a specifically malformed migration payload must be arranged), reliable arbitrary code execution is only 'potential' (DoS is the dependable outcome), and the affected platform is the specialized HPE NonStop port rather than mainstream MQ.

The vendor CVSS 3.1 base of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is driven almost entirely by the aspirational full C/I/H impact assigned to 'potentially execute arbitrary code,' while the description itself frames the primary, reliable outcome as denial of service during queue manager startup and treats code execution as a secondary possibility. Exploitation status is: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC reference in the supplied data, so the elevated CVSS reflects theoretical worst-case impact rather than demonstrated exploitability. The signals that DO temper risk are already in the vector: AC:H (a crafted/malformed cluster migration data condition that must be arranged) and PR:L (the attacker must already be an authenticated MQ participant), and exploitation is further gated on the queue manager restarting to process the tainted migration data. One tension worth flagging: the vector asserts AV:N, but the trigger - 'improper validation of cluster migration data' processed 'during queue manager startup' - implies the attacker must be a legitimate member of the MQ cluster feeding poisoned migration data, which is closer to an authenticated-insider/adjacent scenario than open internet-facing RCE; verify the delivery path with IBM advisory 7287705. Net: a real, patch-worthy heap-corruption issue but not an emergency-tier internet-exploitable RCE - high-CVSS, moderate real-world risk, and confined to a very small NonStop MQ install base.

An authenticated participant in an IBM MQ cluster on HPE NonStop crafts malformed cluster migration data and injects it so that a target queue manager ingests it. When that queue manager is (re)started, the improper validation drives a heap buffer overflow (CWE-122), crashing the queue manager (denial of service) and potentially corrupting heap structures to achieve code execution. No public exploit code is known to exist for this issue at time of analysis.