IBM MQ EUVD-2026-78871

Exploitation requires an authenticated connection to an affected IBM MQ queue manager (PR:L) - the attacker must hold valid MQ credentials or reach a channel configured with weak/blank authentication (e.g. no MCAUSER restriction or CHLAUTH bypass). Given the vector, the attacker then supplies untrusted serialized data that the queue manager deserializes. Affected builds are IBM MQ 9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS, 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS, 9.4.0.0-9.4.5.1 CD, and 10.0.0.0. Limiting factors: valid authentication is mandatory (no unauthenticated path per PR:L), and the fix is available from IBM, so patched or credential-hardened deployments are protected. No user interaction is required (UI:N).

This is a genuine high-priority vulnerability, though not the theoretical worst case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is internally consistent with the description: an authenticated attacker (PR:L) can remotely trigger deserialization of untrusted data to achieve arbitrary code execution with full confidentiality, integrity, and availability impact. The authentication requirement (PR:L) is the key mitigating signal that separates this from a pre-auth wormable bug - the attacker must already possess valid MQ credentials or an authenticated channel, which meaningfully narrows the exploit population to insiders, compromised app-servers, or environments with weak/blank MCAUSER channel authentication. No EPSS score, KEV listing, or POC is present in the provided intelligence, so there is no evidence of active exploitation or public exploit code at time of analysis; the priority rests on the technical severity and the broad affected-version range plus available vendor patch, not on observed attacks. Deserialization RCE classes historically attract exploit development quickly once patches are diffed, so despite the absence of a POC today this warrants prompt patching. No signals directly conflict; the main missing data is EPSS/SSVC to gauge exploitation likelihood.

An attacker with valid MQ credentials (or access via a channel with weak/default authentication) connects to an affected IBM MQ queue manager and submits a crafted serialized Java object payload that the server deserializes without validation, resulting in arbitrary code execution in the MQ process context. No public exploit code is identified at time of analysis, but deserialization flaws of this type are readily weaponized once the patched code is reverse-engineered. Because AC:L, exploitation is reliable and requires no unusual timing once the attacker holds credentials.