Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13275)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer agent Vulnerability Details CVEID:CVE-2026-13275 DESCRIPTION: IBM MQ Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to...

Security Bulletin: IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection (CVE-2026-12351)

Summary IBM MQ has addressed a JNDI injection vulnerability in the Jakarta Resource Adapter IVT servlet that could allow an unauthenticated remote attacker to execute arbitrary code on the hosting application server Vulnerability Details CVEID:CVE-2026-12351 DESCRIPTION: IBM MQ Jakarta Resource...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-10751)

Summary IBM MQ has addressed a Java deserialization filter bypass in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10751 DESCRIPTION: IBM MQ Java and JMS client libraries could allow an authenticated attacker ...

Security Bulletin: IBM MQ queue manager is vulnerable to privilege escalation (CVE-2026-10744)

Summary IBM MQ has addressed an integer truncation vulnerability in the queue manager's MQINQ request handling Vulnerability Details CVEID:CVE-2026-10744 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-10853)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the queue manager's cluster repository manager Vulnerability Details CVEID:CVE-2026-10853 DESCRIPTION: IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrar...

Security Bulletin: IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection (CVE-2026-12354)

Summary IBM MQ has addressed a JNDI injection vulnerability in the Resource Adapter IVT message-driven bean that could allow a remote authenticated attacker with the ability to put messages on the IVT queue to execute arbitrary code on the hosting application server Vulnerability Details...

Security Bulletin: IBM MQ queue manager is vulnerable to denial of service (CVE-2026-12150)

Summary IBM MQ has addressed an unbounded recursion vulnerability in the queue manager's TLS certificate parser that could allow a remote unauthenticated attacker with a valid TLS certificate to cause a denial of service Vulnerability Details CVEID:CVE-2026-12150 DESCRIPTION: IBM MQ could allow a...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid scheduling in rtasosterm It's unsafe to use rtasbusydelay to handle a busy status from the ibm,os-term RTAS function in rtasosterm: Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b BUG:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: The LPAR panics during bootup due to a frozen PE. During the LPAR bootup, the partition firmware provides the ibm,dma-window property for the PE. This property is provided on the PCI bus to which the PE is...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: The BUGON flag has been removed when the event pool is empty. In practice, the driver should never send more commands than are allocated to the event pool. If this happens, the code will assert the BUGON flag. In th...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: ibmvfc: Queue resources are allocated/free only during probe/remove operations. Currently, sub-queues and event pool resources are allocated/free for every CRQ connection event, such as resets and LPM. This exposes the...

Astra Linux – Vulnerability in glibc

The iconv function in the GNU C Library also known as glibc or libc6 versions 2.32 and earlier, when processing invalid multi-byte input sequences in encodings such as IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399, fails to advance the input state properly. This can lead to an infinite loop in...

Security Bulletin: IBM Maximo Application Suite uses httpclient5-5.6.3.jar which is vulnerable to CVE-2026-71290

Summary IBM Maximo Application Suite uses httpclient5-5.6.3.jar which is vulnerable to CVE-2026-71290. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname verification vulnerability in Apache...

Security Bulletin: IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution (CVE-2026-12355)

Summary IBM MQ has addressed a bypass of the JNDI name sanitization in the Resource Adapter IVT servlet that could allow an unauthenticated remote attacker to supply a malicious JNDI URL and execute arbitrary code on the hosting application server if the IVT EAR is deployed Vulnerability Details...

Security Bulletin: IBM MQ is vulnerable to unauthenticated remote code execution (CVE-2026-10747)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the queue manager's protocol handling that could allow an unauthenticated remote attacker with network access to the listener port to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10747 DESCRIPTION: IBM MQ could...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-10858)

Summary IBM MQ has addressed a heap buffer underflow vulnerability in the queue manager's protocol handling that could allow a remote authenticated attacker to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10858 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-11716)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the queue manager's cluster migration message handler Vulnerability Details CVEID:CVE-2026-11716 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during...

Security Bulletin: Due to the use of WebSphere Application Server Liberty, IBM Tivoli Application Dependency Discovery Manager is affected by multiple vulnerabilities

Summary IBM Tivoli Application Dependency Discovery Manager bundles WebSphere Application Server Liberty, vulnerabilities has been remediated in an e-fix CVE-2026-57819, CVE-2026-54225, CVE-2026-64958, CVE-2026-10541, CVE-2026-11548, CVE-2026-11549, CVE-2026-11722,CVE-2026-15396, CVE-2026-15412,...

Security Bulletin: IBM MQ client is vulnerable to remote code execution (CVE-2026-11727)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the MQ client's MQOPEN reply handler that could allow a rogue queue manager or man-in-the-middle attacker on an unencrypted channel to execute arbitrary code on a connecting client Vulnerability Details CVEID:CVE-2026-11727...

Security Bulletin: IBM MQ .NET client is vulnerable to XML external entity injection (CVE-2026-12667)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the IBM MQ .NET client's RFH2 message parser Vulnerability Details CVEID:CVE-2026-12667 DESCRIPTION: IBM MQ could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service...