EUVD-2026-78152
GHSA-mqj8-gj7g-c998
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (us) · only source for this CVE.
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
AnalysisAI
Remote code execution affects IBM MQ across the 9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD and 10.0.0.0 release lines because the queue manager deserializes untrusted data (CWE-502), letting an attacker who can already authenticate to the messaging service run arbitrary code under the broker's privileges. The flaw carries a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and rates as a credentials-gated but fully compromising issue for any exposed MQ listener. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today