IBM MQ EUVD-2026-104477

Exploitation requires an authenticated MQ user (PR:L) with authority to put messages onto a queue that is read by a vulnerable consuming application, and the targeted deployment must run an affected version (IBM MQ 9.4.5.0 through 9.4.5.1). The attack is network-reachable (AV:N) with low complexity (AC:L) and needs no user interaction (UI:N). Limiting factors: valid credentials and put-authority on the relevant queue are mandatory, so the flaw is not exploitable by fully unauthenticated attackers; impact is confined to availability (crash of the consuming application) with no confidentiality or integrity effect, and versions outside the 9.4.5.0-9.4.5.1 range are not affected.

This is a medium-severity, authenticated denial-of-service issue that should be prioritized as routine patch-management rather than emergency response. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack but one that requires valid, low-level credentials (PR:L) and yields only availability impact - no confidentiality or integrity loss. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the authentication requirement: an attacker must already be an authorized MQ user able to put messages onto a queue that a vulnerable consuming application reads. Because MQ is widely used as core enterprise messaging middleware, the blast radius of a crashed consumer can be operationally significant, but the signals are internally consistent (network vector with low-privilege auth, availability-only impact) and point to an insider- or compromised-credential threat model rather than a wormable, unauthenticated internet-facing flaw. No key signals conflict; the main missing data are EPSS/KEV/POC, whose absence lowers urgency but does not eliminate the need to patch.

An authenticated MQ user (or an attacker who has obtained valid MQ credentials) with permission to put messages on a queue sends a single specially crafted message to a queue serviced by a downstream consuming application. When the application dequeues and processes the malformed message, it crashes, interrupting the business process that depends on it. No public exploit code was identified, and exploitation requires only low privileges and low attack complexity per the CVSS vector.