IBM MQ Console EUVD-2026-83131

Requires a valid but non-administrative IBM MQ Console user account and network access to the MQ Console web interface; exploitation then abuses the missing authorization check on the queue-manager create/start operations. It is limited by the need for pre-existing authenticated credentials (PR:L) - this is not exploitable by fully unauthenticated attackers - and by exposure of the MQ Console to the attacker's network position. No special non-default MQ configuration is called out in the advisory beyond the console being enabled and reachable.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, base 7.1) describes a network-reachable, low-complexity authorization flaw exploitable by an already-authenticated non-administrative user of the IBM MQ Console. The dominant impact is availability (A:H) - an underprivileged user can create and start unauthorized queue managers, consuming CPU, memory, disk and port resources on the MQ host - with a secondary integrity impact (I:L) from introducing rogue messaging objects; there is no confidentiality impact (C:N). No EPSS score, KEV listing, or public POC is present in the provided data, so this is best treated as a real-but-not-yet-weaponized authorization defect rather than an actively-exploited emergency. The most important limiting factor is PR:L: the attacker must already hold valid (non-admin) MQ Console credentials, which meaningfully narrows the realistic attacker population to insiders or holders of compromised low-privilege accounts. No SSVC decision data was supplied. Net: a legitimate patch-worthy privilege/authorization issue in widely-deployed middleware, but the authenticated prerequisite and absence of exploitation signals place it below internet-facing unauthenticated flaws in priority.

An insider or an attacker who has phished a low-privilege IBM MQ Console account logs into the web console and, exploiting the missing authorization check, issues requests to create and start new queue managers they should not be permitted to manage. Repeatedly spawning queue managers exhausts host resources (availability impact) and plants attacker-controlled messaging infrastructure. No public exploit code is identified in the provided data.