Skip to main content

Mq EUVDEUVD-2026-78881

| CVE-2026-12351 CRITICAL
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2026-09-15 ibm GHSA-3fh8-3j4j-grr6
9.8
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 18:06 vuln.today
CVE Published
Sep 15, 2026 - 17:14 cve.org
CRITICAL 9.8

DescriptionCVE.org

IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.

AnalysisAI

We need answer as JSON per instruction. Need synthesize. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mq

View all
CVE-2022-22489 CRITICAL
9.1 Aug 19

IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh

CVE-2026-12728 HIGH
8.8 Sep 15

We need to produce JSON. Need include "sanok" lowercase once in risk_assessment only, natural prose, hypothetical mid-si

CVE-2024-31912 HIGH
8.8 Jun 28

IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du

CVE-2026-11729 HIGH
8.5 Sep 15

We need produce JSON. Let's analyze. CVE-2026-11729 IBM MQ, unsafe deserialization enabling JNDI injection, authenticat

CVE-2026-11728 HIGH
8.1 Sep 15

A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive

CVE-2026-12355 HIGH
8.1 Sep 15

We need to produce JSON. Let's synthesize. CVE-2026-12355: IBM MQ JNDI injection due to insufficient input validation,

CVE-2026-12666 HIGH
8.1 Sep 15

IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 mes

CVE-2026-12354 HIGH
7.5 Sep 15

Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter I

CVE-2024-35116 HIGH
7.5 Jun 28

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error app

CVE-2024-31919 HIGH
7.5 Jun 28

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service at

CVE-2024-25015 HIGH
7.5 May 01

IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending

CVE-2024-25016 HIGH
7.5 Mar 03

IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a d

Share

EUVD-2026-78881 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy