IBM MQ CVE-2026-12351

Exploitation requires that the IBM MQ IVT (Installation Verification Test) sample/verification application - part of the MQ Java/JMS classes - is actually deployed on the target; this is a non-default, verification-only component not normally left running in hardened production messaging environments, so its presence is the primary limiting factor. Where it is deployed and network-reachable, a remote attacker needs no authentication or user interaction (per CVSS PR:N/UI:N) to drive the unsafe JNDI lookup to an attacker-controlled endpoint and achieve code execution. Affected builds are IBM MQ 9.3.0.0-9.3.0.41 LTS, 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS, 9.4.0.0-9.4.5.1 LTS, and 10.0.0.0; upgrading to fixed levels or removing the IVT application eliminates the exposure.

The vendor-assigned CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which on its face describes a maximally severe, remote, unauthenticated arbitrary-code-execution flaw - a JNDI-injection pattern (CWE-74) reminiscent of Log4Shell. However, the description contains a decisive scoping qualifier the CVSS vector ignores: exploitation is only possible 'when the IVT application is deployed.' The IVT (Installation Verification Test) is a sample/verification application shipped with IBM MQ's Java/JMS classes and is not part of a normal production messaging configuration, so the real-world attack surface is far narrower than a 9.8 implies. This argues for AC:H rather than AC:L, lowering the practical score into the ~8.1 band. Corroborating signals point to latent rather than active risk: CISA SSVC reports Exploitation: none (no observed exploitation), and there is no CISA KEV listing and no public POC. The one signal that does elevate concern is SSVC Automatable: yes with Technical Impact: total - meaning that where a vulnerable, IVT-deployed instance is reachable, the payoff is full compromise and the attack could be scripted at scale. Net assessment: a genuinely dangerous code-execution bug on paper, but a conditional, non-default-configuration issue in practice; prioritize patching for any environment that actually left the IVT/sample application deployed, while treating the raw 9.8 as an overstatement for typical hardened deployments.

An attacker who can reach an IBM MQ instance that still has the JMS IVT (Installation Verification Test) sample application deployed submits input that drives an unsafe JNDI lookup to an attacker-controlled directory endpoint, causing the MQ Java process to fetch and execute a malicious remote object and run arbitrary code with the process's privileges. No authentication or user interaction is required per the CVSS vector, and SSVC rates the attack automatable, so it could be scripted against exposed hosts. No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, no KEV, no POC).