IBM MQ Java and JMS Client Deserialization Vulnerability

IBM MQ Java and JMS client libraries are susceptible to a critical deserialization filter bypass vulnerability (CVE-2026-10751). The flaw exists within the exception handling mechanism of the libraries. An authenticated attacker who can influence the data processed by a client application using these libraries can trigger this vulnerability to execute arbitrary code. Because the issue resides in the client-side library, any Java application integrating these libraries is potentially at risk if it processes untrusted or attacker-controlled MQ messages. The vulnerability is assigned a CVSS v3.1 score of 7.5, reflecting the risk posed by the ability to achieve remote code execution in the context of the application process. Organizations using IBM MQ client libraries should assess their dependency tree and apply vendor-supplied patches to mitigate the risk of arbitrary code execution.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary code on the host running the vulnerable IBM MQ client application. This can lead to full compromise of the application context, potentially resulting in data exfiltration, lateral movement within the network, or the installation of persistent malicious payloads. The scope of impact is dependent on the privileges of the application process utilizing the library.

Recommendation

• Identify all Java applications utilizing vulnerable versions of IBM MQ Java and JMS client libraries.
• Consult IBM security bulletins to obtain and apply the latest security patches for the IBM MQ client libraries.
• Implement strict input validation and deserialization filters for all incoming MQ messages to prevent processing of malicious serialized objects.
• Monitor for unexpected process creation or unusual network activity originating from Java applications acting as IBM MQ clients.