{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aibmmq9.3.0.0lts/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","cpe:2.3:a:ibm:mq:*:*:*:*:cd:*:*:*","cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:lts:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:lts:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:lts:*:*:*","cpe:2.3:a:ibm:mq:10.0.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-10859"},{"cvss":8.8,"id":"CVE-2026-11376"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ (9.2.0.0 through 9.2.0.44 LTS)","MQ (9.3.0.0 through 9.3.0.42 LTS)","MQ (9.4.0.0 through 9.4.0.26 LTS)","MQ (9.4.0.0 through 9.4.5.1 CD)","MQ (10.0.0.0 through 10.0.0.5 LTS and CD)","MQ (9.2.0.0-9.2.0.44 LTS)","MQ (9.3.0.0-9.3.0.42 LTS)","MQ (9.4.0.0-9.4.0.26 LTS)","MQ (9.4.0.0-9.4.5.1 CD)","MQ (10.0.0.0-10.0.0.5 LTS and CD)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","dos","messaging"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD are vulnerable to an insecure deserialization flaw. An authenticated attacker can exploit this vulnerability by sending malicious ObjectMessage payloads that, when processed by consumer applications, result in remote code execution. No exploit code or specific mitigation patches were detailed in the initial disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAuthenticated attackers can achieve remote code execution on consumer applications processing maliciously crafted ObjectMessage payloads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all IBM MQ instances within the environment to identify versions within the affected ranges.\u003c/li\u003e\n\u003cli\u003eMonitor for administrative authentication and message processing activity originating from untrusted or unexpected sources.\u003c/li\u003e\n\u003cli\u003eCoordinate with IT Operations to apply forthcoming vendor patches provided by IBM for the affected LTS and CD branches.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T22:07:17Z","date_published":"2026-11-04T22:07:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-mq-deserialization/","summary":"An authenticated attacker can execute arbitrary code on consumer applications using IBM MQ due to insecure deserialization of ObjectMessage payloads in specific LTS and CD versions.","title":"IBM MQ: Insecure deserialization remote code execution (CVE-2026-10859)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-mq-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:lts:*:*:*","version":"https://jsonfeed.org/version/1.1"}