Mq
Monthly
An integer overflow in IBM MQ's MQINQ (inquire object attributes) request processing lets an authenticated remote user crash the queue manager and, per the vendor, potentially execute arbitrary code, giving the issue a CVSS 3.1 base score of 8.8 with high confidentiality, integrity and availability impact. Exploitation is network-based against the queue manager listener (default 1414/tcp), requires valid MQ credentials or connection authority (PR:L) and no user interaction; the vendor describes reliable code execution as a potential rather than confirmed outcome, so denial of service is the more assured impact. No public exploit identified at time of analysis, and a vendor fix is available per the IBM advisory.
Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a distribution list send a crafted MQPUT message that corrupts memory handling, reliably crashing the queue manager and potentially enabling arbitrary code execution. The flaw is network reachable with low complexity and no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High), but requires a valid MQ session plus put/queue authority on a reachable queue manager, so it is not exploitable by unauthenticated attackers. No public exploit code or confirmed active exploitation has been identified at time of analysis; an RCE outcome is not confirmed and the reliably achievable impact against affected versions is denial of service, while IBM has published a vendor fix.
IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer overflow triggered when a malformed XA transaction identifier (XID) is parsed, allowing an authenticated attacker with network access to crash the queue manager and potentially execute arbitrary code in its context. Exploitation requires valid credentials and the ability to drive XA transaction operations over an MQ channel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.8), so the reliably achievable outcome is denial of service while code execution remains a potential, not guaranteed, consequence. There is no public exploit identified at time of analysis and no confirmed active exploitation, but a vendor patch is available and the low attack complexity combined with the complete loss of confidentiality, integrity and availability impact makes prompt remediation important.
IBM MQ queue managers running affected releases can be crashed - and, per IBM, potentially have arbitrary code executed on them - by an authenticated participant in an MQ cluster that sends cluster command messages with malformed length fields. The flaw affects MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS and 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS and 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0; it is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 HIGH) but requires a valid cluster identity, and IBM frames code execution only as a possibility while denial of service is the more certain outcome. No public exploit code exists and no public exploit was identified at time of analysis - CISA SSVC records Exploitation: none and Automatable: no - while EPSS estimates exploitation likelihood at roughly 0.36% (29th percentile), so priority should be driven by exposure of clustered queue managers rather than by observed attack activity.
Remote code execution in IBM MQ Java and JMS client libraries allows an authenticated attacker with access to a message queue or topic to bypass the deserialization allow-list filter in exception handling and execute arbitrary code on client applications. The flaw is network-reachable but requires low-privileged authentication (PR:L) and is limited to a specific exception-handling path (AC:H), with impact confined to the client process rather than the MQ server. No public exploit code was identified at time of analysis.
Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to cause a denial of service or potentially escalate privileges by issuing an MQPUT operation that carries a malformed distribution header (the MQDH distribution-list header). The flaw is network-reachable, low complexity, and requires no user interaction (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the assessed impact spanning confidentiality, integrity, and availability, although reliable privilege escalation beyond a crash remains unconfirmed. No public exploit identified at time of analysis, and the vendor has published a patch advisory at IBM support node 7287778.
Authorization bypass in IBM MQ Console allows an authenticated but non-administrative user to create and start queue managers through the web interface, violating intended role separation. This is network-reachable and low-complexity but requires a valid non-admin account (CVSS 3.1 PR:L, base 7.1), with impact limited to low integrity and high availability effects rather than data confidentiality. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a patch advisory.
Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds heap write, allowing a remote attacker to crash the queue manager and, potentially, execute arbitrary code in the MQ process. The issue affects IBM MQ 9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / up to 9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / up to 9.4.5.1 CD, and 10.0.0.0, with the CVSS base of 9.8 reflecting a network-reachable, unauthenticated worst case, though our assessed vector raises attack complexity to High (AC:H) because the channel must be explicitly configured with compression and reachable by the attacker. Denial of service is the readily achievable outcome, while reliable code execution requires defeating the process's memory protections; no public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and EPSS is low at 0.37% (31st percentile).
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delivered by a malicious or compromised queue manager, or by an attacker positioned to man-in-the-middle the client-to-manager channel. Successful exploitation can crash the client for a denial-of-service condition or, more seriously, allow arbitrary code execution in the context of the client process. IBM has released a vendor fix via support bulletin 7284943; there is no public exploit code or CISA KEV entry identified at time of analysis, and the elevated complexity (the attacker must control the server side of the connection) keeps real-world risk below its 8.1 CVSS base score for most deployments.
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / 9.4.0.0-9.4.5.1 CD, and 10.0.0.0) lets an authenticated attacker who can deliver a crafted message trigger JNDI injection and achieve arbitrary code execution inside the consuming client application rather than the queue manager itself. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) characterizes a network-reachable but authentication-gated (PR:L) and high-complexity (AC:H) path whose scope change (S:C) derives from the code execution landing in a downstream client. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available.
Denial of service with possible disclosure of memory contents in IBM MQ (all LTS and CD releases from 9.1.0.0 through 9.4.5.1 and 10.0.0.0) is reachable by a remote attacker who already holds a TLS client certificate the queue manager trusts. Improper validation of deeply nested certificate data during TLS certificate processing produces a stack-based buffer overflow (CWE-121) that can crash the queue manager and potentially expose fragments of process memory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has released fixes via its support advisory.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deployed and network-reachable, because that component performs unsafe JNDI lookups that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can redirect to an attacker-controlled endpoint. Affected builds are IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0, although the non-default, verification-only nature of IVT means exposure is confined to environments where it is actually running and exposed. IBM has released patches, there is no public exploit identified at time of analysis (CISA SSVC exploitation status: none), and while the vendor score of 9.8 reflects total technical impact, our independent assessment raises attack complexity to AC:H to account for the IVT deployment prerequisite.
Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter Installation Verification Test (IVT) application, which fails to properly validate JNDI names. The flaw affects a broad swath of IBM MQ releases: 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, and 10.0.0.0. No public exploit code or CISA KEV entry has been identified at time of analysis, but a vendor patch is available and the CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating full confidentiality, integrity, and availability impact once the attack conditions are met.
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw that can lead to information disclosure or remote code execution. The issue arises from insufficient input validation before JNDI lookup (CWE-74), and according to the supplied CVSS vector it is remotely reachable without authentication (AV:N/AC:H/PR:N/UI:N), though exploitation requires the attacker to also control a network-reachable directory service and successfully resolve malicious object references in the MQ JVM. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to no; IBM has released patches per its advisory.
IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 message headers, letting an authenticated queue user read server-side files or resources and drive the broker and its Java clients into a denial-of-service state. Affected releases span the 9.1.x, 9.2.x, 9.3.x and 9.4.x LTS/CD streams plus 10.0.0.0 Classes for Java, so any environment running the JMS/XMS or Java messaging client against a current broker is in scope. IBM has published a vendor fix and there is no public exploit code or CISA KEV entry identified at time of analysis, but the confidentiality and availability impact are both rated High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N).
XML external entity (XXE) injection in the IBM MQ .NET client allows an authenticated attacker with queue-write access to read files from the host running that client and to cause a limited denial of service when the client parses the RFH2 folder of a crafted message. The flaw is client-side - the queue manager itself and the Java/C clients are not indicated as affected - and the attacker must already hold valid MQ credentials with authority to place messages on a queue the vulnerable client consumes. No public exploit has been identified at time of analysis, CISA's SSVC assessment records no exploitation activity and rates the issue not automatable with partial technical impact, and patch code is available from the vendor; the practical risk is genuine but moderate, well below what the 7.1 base score suggests at first glance.
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a channel configured with weak or blank authentication - deliver malicious serialized data that the queue manager deserializes and executes. The flaw affects the 9.1, 9.2, 9.3, 9.4 and 10.0 streams up to their respective maintenance levels (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS and 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS and 9.4.0.0-9.4.5.1 CD, plus 10.0.0.0), giving a 8.8 CVSS base score with high confidentiality, integrity and availability impact under AV:N/AC:L/PR:L/UI:N/S:U. Because the vector requires PR:L, no unauthenticated path is confirmed; no public exploit code has been identified at time of analysis, and IBM has released a vendor fix.
Crafted messages published into IBM MQ 9.4.5.0 or 9.4.5.1 can crash the applications that consume them, giving an authenticated message producer a denial-of-service primitive against queue-processing services. Successful exploitation requires a valid MQ identity with put authority on a queue that a vulnerable consumer reads; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) confirms the attacker must be authenticated and that only availability is impacted, with no confidentiality or integrity effect. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be handled as routine, medium-severity patch management rather than emergency response, especially since deployments outside the 9.4.5.0-9.4.5.1 range are not affected.
Improper use of cryptographic functions in IBM MQ versions 9.1 through 9.4 allows local attackers with user privileges to modify message integrity through user interaction. The vulnerability affects multiple LTS and CD releases across the supported product line, with no patch currently available. An attacker could manipulate messages in transit to alter their content without detection.
Denial of service in IBM MQ 9.1, 9.2, 9.3 and 9.4 LTS and 9.3/9.4 Continuous Delivery lets remote unauthenticated attackers hold queue manager connections open with slow or incomplete read operations, draining connection and thread resources until legitimate messaging clients can no longer connect. The root cause is improper enforcement of the timeout on individual read operations (CWE-772, resource not released after its effective lifetime), and exploitation requires only network reachability to an IBM MQ TCP listener such as the default channel port 1414 - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). Impact is confined to availability: EPSS is 0.54% (~44th percentile), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), making this a moderate-priority availability issue whose real-world risk is bounded by whether the listener is exposed to untrusted networks.
IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API Exit using MQBUFMH is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3 could disclose sensitive user information from a trace file if that functionality has been enabled. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 7.5.0.0 - 7.5.0.9, 7.1.0.0 - 7.1.0.9, 8.0.0.0 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 command server is vulnerable to a denial of service attack caused by an. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An integer overflow in IBM MQ's MQINQ (inquire object attributes) request processing lets an authenticated remote user crash the queue manager and, per the vendor, potentially execute arbitrary code, giving the issue a CVSS 3.1 base score of 8.8 with high confidentiality, integrity and availability impact. Exploitation is network-based against the queue manager listener (default 1414/tcp), requires valid MQ credentials or connection authority (PR:L) and no user interaction; the vendor describes reliable code execution as a potential rather than confirmed outcome, so denial of service is the more assured impact. No public exploit identified at time of analysis, and a vendor fix is available per the IBM advisory.
Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a distribution list send a crafted MQPUT message that corrupts memory handling, reliably crashing the queue manager and potentially enabling arbitrary code execution. The flaw is network reachable with low complexity and no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High), but requires a valid MQ session plus put/queue authority on a reachable queue manager, so it is not exploitable by unauthenticated attackers. No public exploit code or confirmed active exploitation has been identified at time of analysis; an RCE outcome is not confirmed and the reliably achievable impact against affected versions is denial of service, while IBM has published a vendor fix.
IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer overflow triggered when a malformed XA transaction identifier (XID) is parsed, allowing an authenticated attacker with network access to crash the queue manager and potentially execute arbitrary code in its context. Exploitation requires valid credentials and the ability to drive XA transaction operations over an MQ channel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.8), so the reliably achievable outcome is denial of service while code execution remains a potential, not guaranteed, consequence. There is no public exploit identified at time of analysis and no confirmed active exploitation, but a vendor patch is available and the low attack complexity combined with the complete loss of confidentiality, integrity and availability impact makes prompt remediation important.
IBM MQ queue managers running affected releases can be crashed - and, per IBM, potentially have arbitrary code executed on them - by an authenticated participant in an MQ cluster that sends cluster command messages with malformed length fields. The flaw affects MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS and 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS and 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0; it is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 HIGH) but requires a valid cluster identity, and IBM frames code execution only as a possibility while denial of service is the more certain outcome. No public exploit code exists and no public exploit was identified at time of analysis - CISA SSVC records Exploitation: none and Automatable: no - while EPSS estimates exploitation likelihood at roughly 0.36% (29th percentile), so priority should be driven by exposure of clustered queue managers rather than by observed attack activity.
Remote code execution in IBM MQ Java and JMS client libraries allows an authenticated attacker with access to a message queue or topic to bypass the deserialization allow-list filter in exception handling and execute arbitrary code on client applications. The flaw is network-reachable but requires low-privileged authentication (PR:L) and is limited to a specific exception-handling path (AC:H), with impact confined to the client process rather than the MQ server. No public exploit code was identified at time of analysis.
Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to cause a denial of service or potentially escalate privileges by issuing an MQPUT operation that carries a malformed distribution header (the MQDH distribution-list header). The flaw is network-reachable, low complexity, and requires no user interaction (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the assessed impact spanning confidentiality, integrity, and availability, although reliable privilege escalation beyond a crash remains unconfirmed. No public exploit identified at time of analysis, and the vendor has published a patch advisory at IBM support node 7287778.
Authorization bypass in IBM MQ Console allows an authenticated but non-administrative user to create and start queue managers through the web interface, violating intended role separation. This is network-reachable and low-complexity but requires a valid non-admin account (CVSS 3.1 PR:L, base 7.1), with impact limited to low integrity and high availability effects rather than data confidentiality. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published a patch advisory.
Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds heap write, allowing a remote attacker to crash the queue manager and, potentially, execute arbitrary code in the MQ process. The issue affects IBM MQ 9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / up to 9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / up to 9.4.5.1 CD, and 10.0.0.0, with the CVSS base of 9.8 reflecting a network-reachable, unauthenticated worst case, though our assessed vector raises attack complexity to High (AC:H) because the channel must be explicitly configured with compression and reachable by the attacker. Denial of service is the readily achievable outcome, while reliable code execution requires defeating the process's memory protections; no public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and EPSS is low at 0.37% (31st percentile).
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delivered by a malicious or compromised queue manager, or by an attacker positioned to man-in-the-middle the client-to-manager channel. Successful exploitation can crash the client for a denial-of-service condition or, more seriously, allow arbitrary code execution in the context of the client process. IBM has released a vendor fix via support bulletin 7284943; there is no public exploit code or CISA KEV entry identified at time of analysis, and the elevated complexity (the attacker must control the server side of the connection) keeps real-world risk below its 8.1 CVSS base score for most deployments.
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / 9.4.0.0-9.4.5.1 CD, and 10.0.0.0) lets an authenticated attacker who can deliver a crafted message trigger JNDI injection and achieve arbitrary code execution inside the consuming client application rather than the queue manager itself. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) characterizes a network-reachable but authentication-gated (PR:L) and high-complexity (AC:H) path whose scope change (S:C) derives from the code execution landing in a downstream client. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available.
Denial of service with possible disclosure of memory contents in IBM MQ (all LTS and CD releases from 9.1.0.0 through 9.4.5.1 and 10.0.0.0) is reachable by a remote attacker who already holds a TLS client certificate the queue manager trusts. Improper validation of deeply nested certificate data during TLS certificate processing produces a stack-based buffer overflow (CWE-121) that can crash the queue manager and potentially expose fragments of process memory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has released fixes via its support advisory.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deployed and network-reachable, because that component performs unsafe JNDI lookups that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can redirect to an attacker-controlled endpoint. Affected builds are IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0, although the non-default, verification-only nature of IVT means exposure is confined to environments where it is actually running and exposed. IBM has released patches, there is no public exploit identified at time of analysis (CISA SSVC exploitation status: none), and while the vendor score of 9.8 reflects total technical impact, our independent assessment raises attack complexity to AC:H to account for the IVT deployment prerequisite.
Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter Installation Verification Test (IVT) application, which fails to properly validate JNDI names. The flaw affects a broad swath of IBM MQ releases: 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, and 10.0.0.0. No public exploit code or CISA KEV entry has been identified at time of analysis, but a vendor patch is available and the CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating full confidentiality, integrity, and availability impact once the attack conditions are met.
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw that can lead to information disclosure or remote code execution. The issue arises from insufficient input validation before JNDI lookup (CWE-74), and according to the supplied CVSS vector it is remotely reachable without authentication (AV:N/AC:H/PR:N/UI:N), though exploitation requires the attacker to also control a network-reachable directory service and successfully resolve malicious object references in the MQ JVM. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to no; IBM has released patches per its advisory.
IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 message headers, letting an authenticated queue user read server-side files or resources and drive the broker and its Java clients into a denial-of-service state. Affected releases span the 9.1.x, 9.2.x, 9.3.x and 9.4.x LTS/CD streams plus 10.0.0.0 Classes for Java, so any environment running the JMS/XMS or Java messaging client against a current broker is in scope. IBM has published a vendor fix and there is no public exploit code or CISA KEV entry identified at time of analysis, but the confidentiality and availability impact are both rated High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N).
XML external entity (XXE) injection in the IBM MQ .NET client allows an authenticated attacker with queue-write access to read files from the host running that client and to cause a limited denial of service when the client parses the RFH2 folder of a crafted message. The flaw is client-side - the queue manager itself and the Java/C clients are not indicated as affected - and the attacker must already hold valid MQ credentials with authority to place messages on a queue the vulnerable client consumes. No public exploit has been identified at time of analysis, CISA's SSVC assessment records no exploitation activity and rates the issue not automatable with partial technical impact, and patch code is available from the vendor; the practical risk is genuine but moderate, well below what the 7.1 base score suggests at first glance.
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a channel configured with weak or blank authentication - deliver malicious serialized data that the queue manager deserializes and executes. The flaw affects the 9.1, 9.2, 9.3, 9.4 and 10.0 streams up to their respective maintenance levels (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS and 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS and 9.4.0.0-9.4.5.1 CD, plus 10.0.0.0), giving a 8.8 CVSS base score with high confidentiality, integrity and availability impact under AV:N/AC:L/PR:L/UI:N/S:U. Because the vector requires PR:L, no unauthenticated path is confirmed; no public exploit code has been identified at time of analysis, and IBM has released a vendor fix.
Crafted messages published into IBM MQ 9.4.5.0 or 9.4.5.1 can crash the applications that consume them, giving an authenticated message producer a denial-of-service primitive against queue-processing services. Successful exploitation requires a valid MQ identity with put authority on a queue that a vulnerable consumer reads; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) confirms the attacker must be authenticated and that only availability is impacted, with no confidentiality or integrity effect. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be handled as routine, medium-severity patch management rather than emergency response, especially since deployments outside the 9.4.5.0-9.4.5.1 range are not affected.
Improper use of cryptographic functions in IBM MQ versions 9.1 through 9.4 allows local attackers with user privileges to modify message integrity through user interaction. The vulnerability affects multiple LTS and CD releases across the supported product line, with no patch currently available. An attacker could manipulate messages in transit to alter their content without detection.
Denial of service in IBM MQ 9.1, 9.2, 9.3 and 9.4 LTS and 9.3/9.4 Continuous Delivery lets remote unauthenticated attackers hold queue manager connections open with slow or incomplete read operations, draining connection and thread resources until legitimate messaging clients can no longer connect. The root cause is improper enforcement of the timeout on individual read operations (CWE-772, resource not released after its effective lifetime), and exploitation requires only network reachability to an IBM MQ TCP listener such as the default channel port 1414 - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). Impact is confined to availability: EPSS is 0.54% (~44th percentile), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), making this a moderate-priority availability issue whose real-world risk is bounded by whether the listener is exposed to untrusted networks.
IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API Exit using MQBUFMH is. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3 could disclose sensitive user information from a trace file if that functionality has been enabled. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM MQ 7.5.0.0 - 7.5.0.9, 7.1.0.0 - 7.1.0.9, 8.0.0.0 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 command server is vulnerable to a denial of service attack caused by an. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.