Skip to content
Threat Feed
Subscribe
high advisory

IBM MQ: Insecure deserialization remote code execution (CVE-2026-10859)

An authenticated attacker can execute arbitrary code on consumer applications using IBM MQ due to insecure deserialization of ObjectMessage payloads in specific LTS and CD versions.

CVE search metadata

CVE search record: CVE-2026-10859. Severity: high. CVSS: 7.5. KEV: no. Product: MQ (9.2.0.0 through 9.2.0.44 LTS), MQ (9.3.0.0 through 9.3.0.42 LTS), MQ (9.4.0.0 through 9.4.0.26 LTS), MQ (9.4.0.0 through 9.4.5.1 CD), MQ (10.0.0.0 through 10.0.0.5 LTS and CD), MQ (9.2.0.0-9.2.0.44 LTS), MQ (9.3.0.0-9.3.0.42 LTS), MQ (9.4.0.0-9.4.0.26 LTS), MQ (9.4.0.0-9.4.5.1 CD), MQ (10.0.0.0-10.0.0.5 LTS and CD). Brief: IBM MQ: Insecure deserialization remote code execution (CVE-2026-10859). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-mq-deserialization/

CVE search record: CVE-2026-11376. Severity: high. CVSS: 8.8. KEV: no. Product: MQ (9.2.0.0 through 9.2.0.44 LTS), MQ (9.3.0.0 through 9.3.0.42 LTS), MQ (9.4.0.0 through 9.4.0.26 LTS), MQ (9.4.0.0 through 9.4.5.1 CD), MQ (10.0.0.0 through 10.0.0.5 LTS and CD), MQ (9.2.0.0-9.2.0.44 LTS), MQ (9.3.0.0-9.3.0.42 LTS), MQ (9.4.0.0-9.4.0.26 LTS), MQ (9.4.0.0-9.4.5.1 CD), MQ (10.0.0.0-10.0.0.5 LTS and CD). Brief: IBM MQ: Insecure deserialization remote code execution (CVE-2026-10859). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-mq-deserialization/

Triage facts

Revision 1
Applicability
MQ (9.2.0.0 through 9.2.0.44 LTS), MQ (9.3.0.0 through 9.3.0.42 LTS) +8
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 4, 22:07 UTC
Vulnerabilities
2 CVEs
Source quality
A1Roughly even chance

What's new

  • 1. added coverage for MQ (9.2.0.0-9.2.0.44 LTS) +4 products Nov 4, 22:07 via nvd

IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD are vulnerable to an insecure deserialization flaw. An authenticated attacker can exploit this vulnerability by sending malicious ObjectMessage payloads that, when processed by consumer applications, result in remote code execution. No exploit code or specific mitigation patches were detailed in the initial disclosure.

Impact

Authenticated attackers can achieve remote code execution on consumer applications processing maliciously crafted ObjectMessage payloads.

Recommendation

  • Inventory all IBM MQ instances within the environment to identify versions within the affected ranges.
  • Monitor for administrative authentication and message processing activity originating from untrusted or unexpected sources.
  • Coordinate with IT Operations to apply forthcoming vendor patches provided by IBM for the affected LTS and CD branches.

Immediate actions

Inventory IBM MQ versions to identify instances matching the affected ranges for CVE-2026-10859.

IT Operations 48h

Identify and inventory all IBM MQ instances across the enterprise infrastructure

IT Operations 48h

Threat Hunt

Identify authenticated users or systems pushing serialized objects to IBM MQ consumer queues.

T1059 medium medium confidence hunt now

Data: IBM MQ audit logs or application-level message processing logs

Monitor IBM MQ error logs for unexpected crashes or errors occurring specifically during subscription request processing

T1190 medium medium confidence hunt now

Data: IBM MQ diagnostic and error logs

Mitigations

Apply security patches provided by IBM for affected MQ versions as they become available.

immediate IT Operations

CVE-2026-10859

Apply patches provided by IBM as soon as they become available for the affected versions

immediate IT Operations

CVE-2026-11376