EUVD-2026-78878
GHSA-f7xx-g8p6-mpfr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application.
AnalysisAI
Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter Installation Verification Test (IVT) application, which fails to properly validate JNDI names. The flaw affects a broad swath of IBM MQ releases: 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, and 10.0.0.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
We need answer as JSON per instruction. Need synthesize. Need be careful all fields strings. Let's parse data. CVE: CVE
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh
We need to produce JSON. Need include "sanok" lowercase once in risk_assessment only, natural prose, hypothetical mid-si
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du
We need produce JSON. Let's analyze. CVE-2026-11729 IBM MQ, unsafe deserialization enabling JNDI injection, authenticat
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive
We need to produce JSON. Let's synthesize. CVE-2026-12355: IBM MQ JNDI injection due to insufficient input validation,
IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 mes
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error app
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service at
IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending
IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a d
Share
External POC / Exploit Code
Leaving vuln.today