CVE-2026-14252

Undergoing Analysis Undergoing Analysis - In Progress

IBM MQ Information Disclosure via Log Files

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-14252

EUVD

EUVD-2026-117066

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	MQ	9.2.0.0
IBM	MQ	9.3.0.0
IBM	MQ	9.4.0.0
IBM	MQ	9.4.0.0
IBM	MQ	10.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

IBM MQ versions 9.2.0.0 through 10.0.0.5 have a vulnerability where sensitive information like passwords may be stored in log files. This occurs due to the runmqccred utility improperly handling credentials, allowing local users to access this data.

Detection Guidance

Check IBM MQ log files for entries created by the runmqccred utility. Look for sensitive information stored in logs that could indicate exposure. Review system logs for unauthorized access attempts to these files.

Impact Analysis

A local attacker could exploit this to read sensitive information such as passwords from log files. This may lead to unauthorized access to systems or data, depending on the privileges of the compromised account.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Exposure risks potential violations and penalties.

Mitigation Strategies

Apply the latest cumulative security updates for LTS versions or upgrade to the latest CD versions as recommended by IBM. Ensure proper access controls are in place to restrict local user access to sensitive log files.

Hi! I’m here to help you understand CVE-2026-14252. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...