CVE-2026-12355 IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation,...

CVE-2026-12355 IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation,...

Security Bulletin: IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution (CVE-2026-12355)

Summary IBM MQ has addressed a bypass of the JNDI name sanitization in the Resource Adapter IVT servlet that could allow an unauthenticated remote attacker to supply a malicious JNDI URL and execute arbitrary code on the hosting application server if the IVT EAR is deployed Vulnerability Details...