{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aibmmq/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-11725"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","ibm-mq"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ contains a critical integer overflow vulnerability, identified as CVE-2026-11725, affecting its processing of MQINQ requests. This vulnerability allows an authenticated attacker with access to the messaging system to manipulate input parameters during the MQINQ call sequence, causing a buffer or memory handling error. The impact of successful exploitation ranges from an immediate denial of service (DoS), causing the queue manager to crash or hang, to the potential for remote arbitrary code execution under the context of the IBM MQ service account. Given the privileged nature of message queuing middleware in enterprise environments, this flaw represents a significant risk for lateral movement or infrastructure disruption. Organizations utilizing IBM MQ should prioritize identifying the patch status of their queue managers and implementing access controls to restrict the ability of unauthorized or untrusted users to perform administrative or inquiries on the messaging infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11725 can lead to a complete service disruption of the IBM MQ messaging backbone, affecting all downstream applications that rely on the queue manager. In scenarios resulting in arbitrary code execution, an attacker may gain persistence on the underlying server, potentially accessing sensitive business messages or pivoting into the internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification and patching of all IBM MQ instances. Review IBM security bulletins for the specific version-dependent fixed releases. Audit MQ queue manager access controls to ensure that only authorized service accounts and administrators can invoke MQINQ functions, limiting the potential attack surface.\u003c/p\u003e\n","date_modified":"2026-09-18T22:08:22Z","date_published":"2026-09-18T22:08:22Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11725/","summary":"An integer overflow vulnerability in IBM MQ's processing of MQINQ requests allows an authenticated attacker to trigger a denial of service or potentially execute arbitrary code.","title":"Integer Overflow Vulnerability in IBM MQ Request Processing (CVE-2026-11725)","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11725/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-11381"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","cve","middleware"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ is susceptible to a vulnerability tracked as CVE-2026-11381, which arises from improper validation of message distribution list structures. An attacker who has already gained authentication to the system can exploit this flaw by submitting crafted message distribution lists. Successful exploitation of this vulnerability enables the attacker to disrupt the availability of the MQ service, resulting in a denial of service (DoS), or potentially execute arbitrary code with the privileges of the MQ service process. Given the role of IBM MQ as a middleware for message-oriented communication, compromise of the service could lead to significant operational disruption or privilege escalation on the hosting system. Organizations running IBM MQ should evaluate their current patch levels and prioritize applying updates provided by IBM to remediate this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11381 leads to denial of service or arbitrary code execution, impacting the availability and integrity of messaging middleware infrastructure. This vulnerability targets enterprise messaging environments, which are often central to backend communication between disparate business applications. Unauthorized execution of code could allow an attacker to pivot into internal segments, access sensitive data in transit, or compromise system-level assets integrated with the messaging bus.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReview IBM security bulletins for the specific patches addressing CVE-2026-11381 across all supported IBM MQ versions.\u003c/li\u003e\n\u003cli\u003eImplement strict access control lists for the messaging environment to ensure only authorized entities can submit messages or interact with distribution lists.\u003c/li\u003e\n\u003cli\u003eEnable auditing for administrative and message-processing operations within IBM MQ to identify abnormal structure submissions or service instability.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-18T18:08:13Z","date_published":"2026-09-18T18:08:13Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11381/","summary":"IBM MQ contains a vulnerability in the validation of message distribution list structures that allows an authenticated attacker to trigger a denial of service or potentially execute arbitrary code.","title":"IBM MQ Improper Validation Vulnerability (CVE-2026-11381)","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11381/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-11375"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","denial-of-service"],"_cs_type":"threat","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ, a message-oriented middleware solution, contains a critical security vulnerability identified as CVE-2026-11375. The flaw originates from improper handling of XA (eXtended Architecture) transaction identifiers during processing. An authenticated attacker can exploit this buffer overflow condition by submitting specially crafted transaction identifiers to the message queuing service.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation results in memory corruption, which can lead to the instability of the MQ process, resulting in a denial of service (DoS), or potentially allow for arbitrary code execution in the context of the service. Due to the high CVSS v3.1 score of 8.8, this vulnerability poses a significant risk to the integrity and availability of messaging infrastructure. Organizations utilizing IBM MQ should evaluate their exposure and prioritize patching to mitigate the risk of exploitation by authenticated malicious actors.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11375 enables authenticated attackers to disrupt core messaging services via DoS or gain unauthorized execution capabilities on the host system. This vulnerability affects enterprise environments relying on IBM MQ for transactional data exchange, potentially leading to service outages or lateral movement following code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification of IBM MQ instances within the network environment and apply security updates provided by IBM as soon as they become available. Given the authentication requirement, implement strict access controls on the MQ interface to minimize the number of users capable of interacting with the service.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-11375 immediately upon the release of security updates from IBM.\u003c/li\u003e\n\u003cli\u003eMonitor MQ service logs for frequent restarts or crashes that could indicate DoS attempts.\u003c/li\u003e\n\u003cli\u003eAudit access lists for the MQ interface to ensure only authorized users have connectivity, as the exploit requires authenticated access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:07:59Z","date_published":"2026-09-18T18:07:59Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-overflow/","summary":"IBM MQ is vulnerable to a stack buffer overflow triggered by malicious XA transaction identifiers, allowing an authenticated attacker to cause a denial of service or achieve arbitrary code execution.","title":"Stack Buffer Overflow in IBM MQ XA Transaction Processing","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-10853"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ contains a security vulnerability, identified as CVE-2026-10853, originating from improper validation of cluster command message lengths. The flaw resides within the component responsible for processing cluster-related communications. An authenticated attacker who has successfully gained access to the cluster environment can exploit this validation failure by sending specially crafted command messages. Successful exploitation permits the attacker to trigger a service crash, resulting in a denial of service (DoS), or potentially achieve remote code execution (RCE) on the underlying host. Given the severity of this vulnerability, which carries a CVSS v3.1 base score of 7.5, organizations deploying IBM MQ in clustered configurations are advised to prioritize security updates to mitigate the risk of unauthorized command execution or system instability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-10853 allows an attacker to disrupt critical messaging middleware, leading to service downtime, or potentially gain control over the affected IBM MQ server instance. This impacts enterprise environments that rely on IBM MQ for high-availability messaging and integration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor IBM official security bulletins for the release of patches addressing CVE-2026-10853.\u003c/li\u003e\n\u003cli\u003eApply security patches to all affected IBM MQ instances in clustered environments immediately upon release.\u003c/li\u003e\n\u003cli\u003eReview and restrict cluster membership and administrative access to authorized personnel only, minimizing the pool of potentially malicious authenticated actors.\u003c/li\u003e\n\u003cli\u003eEnsure logging is enabled for IBM MQ cluster command traffic to detect anomalies in message lengths or unusual command patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:07:53Z","date_published":"2026-09-18T18:07:53Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-rce-dos/","summary":"IBM MQ contains a vulnerability (CVE-2026-10853) where improper cluster command message length validation allows authenticated attackers to cause a denial of service or remote code execution.","title":"Vulnerability in IBM MQ Cluster Command Message Validation","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-rce-dos/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-10751"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["IBM MQ (Java and JMS client libraries)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ Java and JMS client libraries are susceptible to a critical deserialization filter bypass vulnerability (CVE-2026-10751). The flaw exists within the exception handling mechanism of the libraries. An authenticated attacker who can influence the data processed by a client application using these libraries can trigger this vulnerability to execute arbitrary code. Because the issue resides in the client-side library, any Java application integrating these libraries is potentially at risk if it processes untrusted or attacker-controlled MQ messages. The vulnerability is assigned a CVSS v3.1 score of 7.5, reflecting the risk posed by the ability to achieve remote code execution in the context of the application process. Organizations using IBM MQ client libraries should assess their dependency tree and apply vendor-supplied patches to mitigate the risk of arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to execute arbitrary code on the host running the vulnerable IBM MQ client application. This can lead to full compromise of the application context, potentially resulting in data exfiltration, lateral movement within the network, or the installation of persistent malicious payloads. The scope of impact is dependent on the privileges of the application process utilizing the library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all Java applications utilizing vulnerable versions of IBM MQ Java and JMS client libraries.\u003c/li\u003e\n\u003cli\u003eConsult IBM security bulletins to obtain and apply the latest security patches for the IBM MQ client libraries.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and deserialization filters for all incoming MQ messages to prevent processing of malicious serialized objects.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected process creation or unusual network activity originating from Java applications acting as IBM MQ clients.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:07:45Z","date_published":"2026-09-18T18:07:45Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-rce/","summary":"An authenticated attacker can execute arbitrary code on client applications by exploiting a deserialization filter bypass in IBM MQ Java and JMS client libraries.","title":"IBM MQ Java and JMS Client Deserialization Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-10027"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ, a message-oriented middleware used for enterprise application integration, contains a critical memory corruption vulnerability identified as CVE-2026-10027. The vulnerability exists within the software's handling of compressed data on channels where compression is explicitly enabled. An unauthenticated remote attacker can exploit this flaw by sending specially crafted, malformed compressed data packets to a listening channel. Successful exploitation of this buffer overflow condition allows the attacker to crash the target IBM MQ process, resulting in a denial of service, or potentially achieve arbitrary code execution under the privileges of the MQ service. This impact is significant for organizations relying on IBM MQ for core business messaging, as it compromises both the availability and integrity of communication infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 base score of 8.1, reflecting its potential for remote code execution. If exploited, an attacker could disrupt critical enterprise messaging services, leading to system-wide data transit outages, or gain unauthorized control over affected message queue managers, facilitating further lateral movement or data exfiltration within the organization's internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security operations and IT teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM MQ across the enterprise and verify if channel compression is enabled.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided security patches for CVE-2026-10027 to all IBM MQ installations immediately upon release.\u003c/li\u003e\n\u003cli\u003eIn environments where patching is delayed, consider disabling channel compression as a temporary mitigation to prevent the trigger for this specific buffer overflow.\u003c/li\u003e\n\u003cli\u003eReview network configurations to restrict access to IBM MQ listener ports to authorized endpoints only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:07:28Z","date_published":"2026-09-18T18:07:28Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-buffer-overflow/","summary":"IBM MQ is vulnerable to a buffer overflow during the processing of malformed compressed data, which can be leveraged by a remote attacker for denial of service or arbitrary code execution.","title":"Buffer Overflow Vulnerability in IBM MQ","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-buffer-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-12666"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["IBM MQ (9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0)","IBM MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","java","middleware","cve-2026-12666","rce","dos"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ Classes for Java is susceptible to an XML external entity (XXE) injection vulnerability, identified as CVE-2026-12666. This flaw exists within the processing logic of the MQRFH2 header, which is utilized for message metadata in IBM MQ environments. By submitting specially crafted MQRFH2 headers containing malicious XML external entities, an authenticated attacker can force the application to process unauthorized file inclusions or external URI requests. Successful exploitation enables the attacker to read sensitive files from the underlying host filesystem or trigger resource exhaustion, resulting in a denial-of-service (DoS) condition. This vulnerability affects a wide range of IBM MQ LTS and CD releases across various versions including 9.1, 9.2, 9.3, 9.4, and 10.0. Given the high CVSS base score of 8.1, organizations running these versions of IBM MQ Classes for Java should prioritize patching as recommended by IBM.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a significant risk to the integrity and availability of IBM MQ deployments. If successfully exploited, attackers can potentially exfiltrate configuration files, system credentials, or other sensitive data accessible to the user context running the Java process. Furthermore, the capacity to induce a denial-of-service attack can disrupt critical messaging middleware services, impacting downstream applications that rely on IBM MQ for data transmission and integration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate IBM MQ Classes for Java to the latest patched version as specified in the official IBM security bulletin to remediate CVE-2026-12666.\u003c/li\u003e\n\u003cli\u003eAudit IBM MQ queue manager configurations to restrict the use of unauthenticated or unauthorized applications that can inject messages into protected queues, as exploitation requires an authenticated session.\u003c/li\u003e\n\u003cli\u003eReview existing Java application logs for anomalies in MQRFH2 header processing or unusual file access patterns originating from the JVM process.\u003c/li\u003e\n\u003cli\u003eSince this is a library-level vulnerability, coordinate with application development teams to identify and re-bundle updated IBM MQ JAR files into affected custom Java applications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:08:07Z","date_published":"2026-09-15T19:42:56Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-12666/","summary":"An XML external entity injection vulnerability (CVE-2026-12666) in IBM MQ Classes for Java allows authenticated attackers to perform denial-of-service attacks or disclose sensitive host information by manipulating MQRFH2 headers.","title":"XML External Entity Injection in IBM MQ Classes for Java","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-12666/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-13275"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ (9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0 Managed File Transfer)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ, a message-oriented middleware solution, contains a vulnerability identified as CVE-2026-13275 that stems from improper handling of XML input during reply message processing. This vulnerability enables an authenticated attacker to perform XML External Entity (XXE) injection attacks. By submitting specifically crafted XML messages, an attacker can coerce the IBM MQ application into reading arbitrary files from the host filesystem or performing unauthorized Server-Side Request Forgery (SSRF) requests to internal or external network resources. This flaw impacts multiple long-term support (LTS) and continuous delivery (CD) versions of IBM MQ, as well as the Managed File Transfer component. Given that IBM MQ often handles sensitive financial or operational data, successful exploitation could lead to the exposure of configuration files, credentials, or internal network mapping.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows authenticated attackers to bypass security boundaries within the messaging environment. Successful exploitation leads to unauthorized access to sensitive local files and the ability to conduct SSRF, potentially escalating access within the internal network. The scope covers a wide range of IBM MQ versions, impacting organizations relying on this middleware for enterprise application integration. If exploited, an attacker could exfiltrate configuration data or pivot to other internal services that are not directly exposed to the internet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and IT teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch IBM MQ installations to the latest version as recommended by IBM to remediate CVE-2026-13275.\u003c/li\u003e\n\u003cli\u003eAudit IBM MQ message flow configurations to identify and restrict untrusted XML input sources.\u003c/li\u003e\n\u003cli\u003eMonitor MQ audit logs for unusual file access patterns or connection attempts originating from the IBM MQ service account.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-14T21:36:04Z","date_published":"2026-09-14T21:36:04Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-xxe/","summary":"An XML external entity injection vulnerability in IBM MQ allows authenticated attackers to perform arbitrary file reads or server-side request forgery during reply message processing.","title":"IBM MQ XML External Entity Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}