IBM MQ EUVD-2026-83021

Requires the IBM MQ Java or JMS client libraries to be in use by a consuming application. The attacker needs authenticated access to MQ (PR:L) or control over a queue/topic/message source the victim client reads, so that attacker-controlled serialized data reaches the client. Exploitation is limited to the specific exception-handling code path where the deserialization allow-list filter is bypassed (reflected by AC:H), and impact is confined to the client application process rather than the MQ server. No user interaction is required (UI:N). The vulnerable component is the client library, so server-only deployments without affected Java/JMS clients are not exposed.

The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) reflects a network-reachable but non-trivial code-execution flaw requiring authentication. Several signals temper the raw score: AC:H indicates the deserialization-filter bypass triggers only along a specific exception-handling path rather than trivially, and PR:L means the attacker must be an authenticated MQ participant, not an anonymous internet actor. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation is not yet demonstrated: no public exploit identified at time of analysis. A key nuance is that the impact lands on the CLIENT application, not the MQ server - so 'network attack vector' here typically means a malicious or compromised message/queue source feeds crafted serialized data back to the Java/JMS client, inverting the usual server-target threat model. Net: a credible, patch-worthy High for organizations running IBM MQ Java/JMS clients, but not an emergency-grade, mass-exploited priority given AC:H, PR:L, absent EPSS/KEV/POC, and the client-side (rather than server-side) blast radius.

An attacker with valid MQ credentials (or control of a queue/topic a victim client consumes from) places crafted serialized Java objects that, when the client library encounters an error and enters its exception-handling deserialization path, bypass the object-input allow-list filter and instantiate attacker-chosen gadget classes. When the victim Java/JMS client application processes the message, arbitrary code executes in the client process. No public exploit code was provided, and the AC:H rating reflects that reaching the vulnerable exception path requires specific conditions.