CVE-2026-12356

Undergoing Analysis Undergoing Analysis - In Progress

IBM MQ Command Injection Vulnerability

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-12356

EUVD

EUVD-2026-117073

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	MQ	9.2.0.0
IBM	MQ	9.3.0.0
IBM	MQ	9.4.0.0
IBM	MQ	9.4.0.0
IBM	MQ	10.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM MQ allows an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands. It affects multiple versions of IBM MQ, including LTS and CD releases.

Detection Guidance

Detecting this vulnerability requires checking if your IBM MQ versions fall within the affected ranges (9.2.0.0-9.2.0.44, 9.3.0.0-9.3.0.42, 9.4.0.0-9.4.0.26, 9.4.0.0-9.4.5.1, or 10.0.0.0-10.0.0.5). Review IBM MQ logs for suspicious Ant script command executions or unauthorized code injection attempts.

Impact Analysis

An attacker could exploit this to run unauthorized code on the system, potentially leading to data breaches, system compromise, or disruption of services. The impact includes loss of confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must address it to maintain compliance.

Mitigation Strategies

Apply the latest security updates or cumulative fixes for your IBM MQ version: 9.2.0.46 for 9.2 LTS, 9.3.0.43 for 9.3 LTS, 9.4.0.30 for 9.4 LTS, upgrade to 10.0.0.6 for 10.0 LTS, or upgrade to 10.0.1.0 for 9.4 CD and 10.0 CD. No workarounds are available.

Hi! I’m here to help you understand CVE-2026-12356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...