CVE-2026-12354 IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to...

Security Bulletin: IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection (CVE-2026-12354)

Summary IBM MQ has addressed a JNDI injection vulnerability in the Resource Adapter IVT message-driven bean that could allow a remote authenticated attacker with the ability to put messages on the IVT queue to execute arbitrary code on the hosting application server Vulnerability Details...