IBM MQ: Twelve High-to-Critical Vulnerabilities Disclosed Together on September 18, 2026
IBM MQ faces a critical security event with twelve vulnerabilities disclosed on September 18, 2026, impacting message processing and potentially allowing code execution.
Key findings
- Twelve IBM MQ vulnerabilities disclosed on September 18, 2026, ranging from High to Critical severity.
- Multiple flaws involve improper data validation, integer overflows, and buffer overflows.
- Vulnerabilities can lead to denial of service, sensitive information disclosure, and arbitrary code execution.
- CVE-2026-10858 is a Critical severity flaw due to a heap buffer underflow in multi-segment message processing.
- IBM MQ Java and JMS client libraries are affected by CVE-2026-10751, a deserialization filter bypass.
- Patches and updates are available; prompt application is recommended.
On September 18, 2026, IBM disclosed a significant batch of twelve vulnerabilities affecting its MQ messaging middleware. The vulnerabilities, disclosed within a four-hour window, range in severity from High to Critical, with several allowing authenticated attackers to achieve denial of service or even execute arbitrary code. The widespread nature of these flaws underscores the importance of timely patching and security diligence for IBM MQ deployments.
Several vulnerabilities stem from improper validation of various data structures and values within MQ processing. CVE-2026-11726 and CVE-2026-11378, for instance, are related to improper validation of message header offsets and distribution list structures, respectively, potentially leading to sensitive information disclosure, denial of service, or arbitrary code execution. Similarly, CVE-2026-11716 highlights issues during queue manager startup due to improper validation of cluster migration data, while CVE-2026-10853 points to improper validation of cluster command message lengths.
Integer overflows are another recurring theme in this disclosure. CVE-2026-11725 and CVE-2026-10744 involve integer overflows in MQINQ request processing and MQINQ request validation, respectively, with potential for denial of service or arbitrary code execution. CVE-2026-11375 describes a similar integer overflow during XA transaction identifier processing, also leading to potential code execution.
Buffer overflows present a critical threat in this batch. CVE-2026-10858, a Critical severity vulnerability, is due to a heap buffer underflow when processing multi-segment messages. CVE-2026-110575 involves a heap buffer overflow during MQPUT operations with malformed distribution headers. Additionally, CVE-2026-10027 details a buffer overflow when processing malformed compressed data on channels configured with compression.
A specific vulnerability, CVE-2026-10751, affects the IBM MQ Java and JMS client libraries, allowing an authenticated attacker to bypass deserialization filters in exception handling, potentially leading to arbitrary code execution on client applications.
IBM has provided patches and updates for the affected versions of MQ. Users are strongly advised to consult the official IBM security advisories for detailed information on affected versions and the specific fixes released. Prompt application of these patches is crucial to mitigate the risks associated with these vulnerabilities.
This coordinated disclosure of twelve vulnerabilities highlights a critical security period for IBM MQ users. The range of potential impacts, from denial of service to arbitrary code execution, necessitates immediate attention to patching and security posture review. Organizations relying on IBM MQ should prioritize updating to the latest secure versions to protect their messaging infrastructure.