Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-11979 DESCRIPTION: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell functi...

CVE-2026-11725 IBM MQ queue manager is vulnerable to privilege escalation

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing...

CVE-2026-11716 IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data...

CVE-2026-10030

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2026-11378 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing...

CVE-2026-11378 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing...

CVE-2026-11375 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers...

CVE-2026-10853 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths...

CVE-2026-10575 IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers...

EUVD-2026-83131

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2026-10027 IBM MQ queue manager is vulnerable to unauthenticated remote code execution

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled...

CVE-2026-11728

This vulnerability affects the IBM MQ .NET client 's asynchronous message receive handler, where a heap buffer overflow (CWE-787) can allow a remote attacker to cause a denial of service or potentially execute arbitrary code. The attack requires a malicious queue manager or a man-in-the-middle po...

CVE-2026-12150 IBM MQ queue manager is vulnerable to denial of service

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and...

CVE-2026-12150 IBM MQ queue manager is vulnerable to denial of service

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and...

Security Bulletin: IBM MQ Console is vulnerable to privilege escalation

Summary IBM MQ has addressed a missing authorization check in the IBM MQ Console that could allow a remote authenticated user with read-only console access to create and start queue managers on the host Vulnerability Details CVEID:CVE-2026-10030 DESCRIPTION: IBM MQ Console allows authenticated...

Security Bulletin: IBM MQ is vulnerable to unauthenticated remote code execution (CVE-2026-10747)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the queue manager's protocol handling that could allow an unauthenticated remote attacker with network access to the listener port to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10747 DESCRIPTION: IBM MQ could...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-10858)

Summary IBM MQ has addressed a heap buffer underflow vulnerability in the queue manager's protocol handling that could allow a remote authenticated attacker to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10858 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-11716)

Summary IBM MQ has addressed a heap buffer overflow vulnerability in the queue manager's cluster migration message handler Vulnerability Details CVEID:CVE-2026-11716 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during...

Security Bulletin: IBM MQ is vulnerable to remote code execution (CVE-2026-11381)

Summary IBM MQ has addressed a heap out-of-bounds memory corruption vulnerability in the queue manager's message descriptor conversion that could allow a remote authenticated attacker to execute arbitrary code. Vulnerability Details CVEID:CVE-2026-11381 DESCRIPTION: IBM MQ could allow an...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-11378)

Summary IBM MQ has addressed an integer overflow vulnerability in the queue manager's object descriptor conversion that could allow a remote authenticated attacker to write zeros to arbitrary heap memory locations, leading to remote code execution. Vulnerability Details CVEID:CVE-2026-11378...