IBM MQ CVE-2026-11727

Exploitation requires the victim MQ C client (IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40) to request AMS (Advanced Message Security) policy data from a queue manager, and requires the attacker to control the queue manager's responses - i.e. operate a malicious/compromised queue manager or man-in-the-middle the client-to-queue-manager channel. This server-side positioning requirement is the primary limiting factor and is reflected in AC:H. Exploitation is confined to deployments that use AMS policy retrieval; clients not requesting AMS policy data are not on the vulnerable path. The victim client itself needs no authentication (PR:N), but the attacker cannot exploit a client that only ever connects to a trusted, uncompromised queue manager over a protected channel.

This is a client-side memory-safety flaw (CWE-122, heap-based buffer overflow) in the IBM MQ C client for HPE NonStop, where the client improperly validates queue manager responses when requesting AMS (Advanced Message Security) policy data. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) is internally consistent with a network-reachable, unauthenticated-victim, high-complexity flaw yielding full C/I/A impact via potential code execution. The critical caveat is directionality: the 'attacker' must control or impersonate the queue manager (a rogue/compromised QM or a man-in-the-middle on the client-QM channel) to deliver the malformed AMS policy response - this is exactly why AC:H is assigned and why PR:N is technically correct (the victim client needs no privilege) but somewhat misleading, since real-world exploitation requires a privileged network position or a subverted server. No EPSS score, KEV listing, or public POC is present in the input, so there is no signal of active or imminent exploitation. A vendor patch IS confirmed available (IBM node 7287708). Net: a genuinely serious flaw where it applies (RCE potential), but real risk is dampened by AC:H, the niche NonStop platform, the 'potentially' hedge on code execution, and the attacker-in-server-position precondition. Treat as a patch-soon item for the small population of HPE NonStop MQ deployments rather than a broad-fire emergency.

An attacker who operates a rogue IBM MQ queue manager, or who man-in-the-middles an existing client-to-queue-manager channel, waits for an MQ C client on HPE NonStop to request AMS policy data. The malicious queue manager returns a crafted, improperly-sized policy response that overflows a heap buffer in the client, crashing the client (DoS) or potentially achieving arbitrary code execution in the client process. No public exploit code is identified at time of analysis.