IBM MQ CVE-2026-11728

Exploitation requires that an affected IBM MQ client receive a crafted message from a queue manager the attacker controls or has compromised, or that the attacker sit in a man-in-the-middle position on the client's MQ channel - this second path is only realistic when the channel is not protected by TLS or where TLS is used without proper peer certificate and hostname validation. There is no authentication requirement on the client side (CVSS PR:N) and no user interaction (UI:N), but the attacker must own or impersonate the server end of the connection, which is why the vector is AC:H; a client that talks exclusively to internally controlled queue managers over strictly validated TLS has no reachable attack surface for this flaw. Exploitation is further limited by version: only the listed 9.1.x, 9.2.x, 9.3.x, 9.4.x and 10.0.0.0 builds are vulnerable, and patched maintenance levels close the issue. Successful code execution also depends on heap grooming and the memory layout of the client process, so a reliable RCE is harder to achieve than the denial-of-service outcome, which is the more attainable near-term impact.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1) accurately reflects the unusual shape of this issue: the attack is network-borne and needs no credentials or user interaction, but it carries high complexity because the adversary must either operate a malicious queue manager the victim's client connects to, or achieve a man-in-the-middle position on an insufficiently protected channel - this is why AC:H is appropriate rather than a trivially automatable remote exploit, and even a mid-sized municipal IT team in inowroclaw should treat this as urgent if it exposes MQ clients to third-party or untrusted queue managers. The scope is unchanged (S:U) but all three impact metrics are High, since heap corruption can yield both code execution and full client-process availability loss. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no evidence of mass exploitation; conversely, absence of KEV is not evidence that targeted abuse is impossible. Signals are consistent rather than conflicting: high CVSS severity is moderated by high attack complexity and a server-side prerequisite, so this is a genuine patch-now item for environments that connect MQ clients across trust boundaries, but it is not a wormable, internet-wide emergency. Notably, the exploitability is configuration-dependent - an estate that strictly validates TLS peers and only connects to internally controlled queue managers has a materially smaller exposure than its raw CVSS score implies.

An attacker who controls or compromises a queue manager that victim MQ clients are configured to poll - or who can intercept an unprotected client-to-manager TCP channel - sends a message with malformed length or field data; the vulnerable client library copies more data than the heap buffer holds, corrupting heap metadata. Depending on heap layout and the code executed after corruption, the client either crashes (denial of service) or the attacker gains code execution in the client process; exploitation is complex because the attacker must be in the server-side or MITM position and may need to shape the heap, and no public PoC was identified at time of analysis.