AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-12351

IBM MQ: remote code execution

IBM

CVE-2026-12351 · Published Sep 15, 2026 · updated Sep 16, 2026

Critical9.8
No fix yet
IBM advisory

IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.

Affected versions

PackageAffectedFixed in
MQ
Product
>= 9.3.0.0, <= 9.3.0.41 LTSNo fix yet
>= 9.3.0.0, <= 9.3.5.1 CDNo fix yet
>= 9.4.0.0, <= 9.4.0.25 LTSNo fix yet
>= 9.4.0.0, <= 9.4.5.1 LTSNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-74

More IBM advisories

All IBM
Medium 5.4Sep 15IBM Cloud Pak for Business Automation: cross-site scriptingCVE-2026-12751no fix yetHigh 7.1Sep 15IBM Business Automation Workflow containers and traditional: XML external entityCVE-2026-12752no fix yetHigh 7.5Sep 15IBM Security Verify Access: denial of serviceCVE-2026-12358no fix yetHigh 8.1Sep 15IBM MQ: information disclosureCVE-2026-12666no fix yetHigh 7.1Sep 15IBM MQ: denial of serviceCVE-2026-12667no fix yetHigh 8.8Sep 15IBM MQ: code executionCVE-2026-12728no fix yet