Security Bulletin: IBM MQ .NET client is vulnerable to XML external entity injection (CVE-2026-12667)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the IBM MQ .NET client's RFH2 message parser Vulnerability Details CVEID:CVE-2026-12667 DESCRIPTION: IBM MQ could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service...

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13287)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer monitor result parser Vulnerability Details CVEID:CVE-2026-13287 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: IBM MQ Java messaging is vulnerable to XML external entity injection (CVE-2026-12666)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the IBM MQ Classes for Java client's RFH2 header parser Vulnerability Details CVEID:CVE-2026-12666 DESCRIPTION: IBM MQ Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial ...

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13285)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer template parser Vulnerability Details CVEID:CVE-2026-13285 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affecting Tivoli Netcool/OMNIbus

Summary Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus probes and/or gateways have been addressed. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-11729)

Summary IBM MQ has addressed a Java deserialization vulnerability in the IBM MQ Java client's internal command manager Vulnerability Details CVEID:CVE-2026-11729 DESCRIPTION: IBM MQ Java client library could allow an authenticated attacker to execute arbitrary code in client applications due to...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-12728)

Summary IBM MQ has addressed a deserialization filter bypass vulnerability in the IBM MQ Java client's distributed messaging component that could allow a remote authenticated attacker to execute arbitrary code by delivering crafted serialized messages that bypass the configured deserialization...

Security Bulletin: IBM MQ .NET client is vulnerable to remote code execution (CVE-2026-11728)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the IBM MQ .NET client's asynchronous message receive handler Vulnerability Details CVEID:CVE-2026-11728 DESCRIPTION: IBM MQ .NET Client could allow a remote attacker to cause a denial of service or potentially execute arbitrary...

Security Bulletin: IBM MQ queue manager is vulnerable to privilege escalation (CVE-2026-11725)

Summary IBM MQ has addressed an integer overflow vulnerability in the queue manager's MQINQ request validation Vulnerability Details CVEID:CVE-2026-11725 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer...

Security Bulletin: Multiple Vulnerabilities in Apache Struts library affect IBM Tivoli Netcool/OMNIbus WebGUI (CVE-2026-73635, CVE-2026-73634)

Summary IBM Tivoli Netcool/OMNIbus WebGUI uses the Apache Struts framework to handle HTTP request processing and web application routing. Vulnerability Details CVEID:CVE-2026-73634 DESCRIPTION: Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoi...

Security Bulletin: IBM MQ is vulnerable to remote code execution (CVE-2026-11381)

Summary IBM MQ has addressed a heap out-of-bounds memory corruption vulnerability in the queue manager's message descriptor conversion that could allow a remote authenticated attacker to execute arbitrary code. Vulnerability Details CVEID:CVE-2026-11381 DESCRIPTION: IBM MQ could allow an...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-11378)

Summary IBM MQ has addressed an integer overflow vulnerability in the queue manager's object descriptor conversion that could allow a remote authenticated attacker to write zeros to arbitrary heap memory locations, leading to remote code execution. Vulnerability Details CVEID:CVE-2026-11378...

Security Bulletin: IBM MQ queue manager is vulnerable to information disclosure and denial of service (CVE-2026-11726)

Summary IBM MQ has addressed an out-of-bounds memory read and write vulnerability in the queue manager's message conversion handling that could allow a remote authenticated attacker to obtain sensitive information from heap memory or cause a denial of service Vulnerability Details...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-11375)

Summary IBM MQ has addressed a stack buffer overflow vulnerability in the queue manager's XA transaction handling that could allow a remote authenticated attacker to execute arbitrary code by sending a crafted transaction identifier Vulnerability Details CVEID:CVE-2026-11375 DESCRIPTION: IBM MQ...

Security Bulletin: IBM MQ REST API and Console is vulnerable to multiple security issues

Summary IBM MQ has addressed multiple vulnerabilities in the axios HTTP client library used by the IBM MQ REST API and Console Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11806)

Summary An arbitrary file read vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11541)

Summary An HTTP request smuggling vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatform...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2026-9320,CVE-2026-8646)

Summary Multiple issues were identified with IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality. Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere...

Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-9071)

Summary A denial of service vulnerability was identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality Vulnerability Details CVEID:CVE-2026-9071 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2026-50645,CVE-2026-9322,CVE-2026-9171)

Summary Multiple issues were identified with IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a...