CVE-2026-12355
Received Received - Intake

IBM MQ JNDI Injection Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: IBM Corporation

Description
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-12355
EUVD
EUVD-2026-78877

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
ibm mq From 9.1.0.0 (inc) to 9.1.0.37 (inc)
ibm mq From 9.2.0.0 (inc) to 9.2.0.43 (inc)
ibm mq From 9.3.0.0 (inc) to 9.3.0.41 (inc)
ibm mq From 9.3.0.0 (inc) to 9.3.5.1 (inc)
ibm mq From 9.4.0.0 (inc) to 9.4.0.25 (inc)
ibm mq From 9.4.0.0 (inc) to 9.4.5.1 (inc)
ibm mq 10.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM MQ versions 9.1.0.0 through 10.0.0.0 allows an attacker to perform JNDI injection attacks due to insufficient input validation. This could lead to information disclosure or remote code execution if a malicious JNDI URL is supplied to the vulnerable IBM MQ Resource Adapter IVT servlet.

Detection Guidance

To detect this vulnerability, check if IBM MQ Resource Adapter IVT servlet is deployed on your application server. Inspect logs for suspicious JNDI URL requests or unauthenticated remote code execution attempts targeting IBM MQ versions listed in the CVE.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the hosting application server where the IBM MQ IVT EAR is deployed. This may result in unauthorized access, data breaches, or system compromise, depending on the server's configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information security). Organizations must address this flaw to maintain regulatory compliance and protect sensitive data.

Mitigation Strategies

Apply cumulative security updates for affected IBM MQ LTS versions or upgrade to IBM MQ version 10.0.0.5 for CD versions. Ensure the IVT EAR is not deployed if not required. Monitor for any signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart