IBM MQ NonStop CVE-2026-11726

Exploitation requires network access to an IBM MQ for HPE NonStop queue manager running an affected build (8.1.0 through 8.1.0.40) AND valid authentication credentials (CVSS PR:L - an authenticated MQ user, not anonymous). The attacker must be able to submit a message whose header contains an attacker-controlled offset value that the queue manager validates improperly, triggering the out-of-bounds read. Limiting factors: the requirement for valid credentials rules out fully unauthenticated abuse, and the affected component is confined to the HPE NonStop platform port of MQ rather than all MQ installations, substantially narrowing the exposed population; no user interaction is required (UI:N).

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H = 8.1 High) describes a network-reachable, low-complexity flaw requiring only low-level authentication, yielding high confidentiality and availability impact with no integrity impact - consistent with a CWE-125 out-of-bounds read that both leaks memory (C:H) and crashes the queue manager (A:H). Signal alignment is good: the CWE (OOB read), the description ('obtain sensitive information or cause a denial of service'), and the C:H/I:N/A:H impact profile all corroborate each other, and a vendor patch is confirmed available. However, several exploitation-priority signals are ABSENT from the input: no EPSS probability, no CISA KEV listing, and no public POC - so there is no evidence of active or imminent exploitation. Per the precision rules this is 'no public exploit identified at time of analysis.' The realistic risk is therefore a genuine but not urgent issue: it requires valid credentials (PR:L) to an MQ queue manager, and the affected platform (IBM MQ specifically for HPE NonStop) is a niche, high-assurance deployment rather than a mass-Internet target. C:H may be slightly generous for a bounded OOB read that typically leaks adjacent header/buffer bytes, but it is defensible given 'sensitive information.' Priority: patch on normal cycle; not a drop-everything emergency absent exploitation signals.

An attacker who already holds valid (low-privilege) MQ credentials connects to an IBM MQ for HPE NonStop queue manager and sends a message crafted with a malformed header offset value that falls outside the intended buffer bounds. When the queue manager parses the header, the out-of-bounds read either returns adjacent memory to the attacker (disclosing sensitive data) or dereferences an invalid location and crashes the process, denying service. No public exploit code is identified at time of analysis.