MQ (9.4.0.0-9.4.0.26 LTS) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mq-9.4.0.0-9.4.0.26-lts/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 22:07:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIBM MQ: Insecure deserialization remote code execution (CVE-2026-10859)https://feed.craftedsignal.io/briefs/2026-11-ibm-mq-deserialization/Wed, 04 Nov 2026 22:07:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ibm-mq-deserialization/An authenticated attacker can execute arbitrary code on consumer applications using IBM MQ due to insecure deserialization of ObjectMessage payloads in specific LTS and CD versions.IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD are vulnerable to an insecure deserialization flaw. An authenticated attacker can exploit this vulnerability by sending malicious ObjectMessage payloads that, when processed by consumer applications, result in remote code execution. No exploit code or specific mitigation patches were detailed in the initial disclosure.

Impact

Authenticated attackers can achieve remote code execution on consumer applications processing maliciously crafted ObjectMessage payloads.

Recommendation

  • Inventory all IBM MQ instances within the environment to identify versions within the affected ranges.
  • Monitor for administrative authentication and message processing activity originating from untrusted or unexpected sources.
  • Coordinate with IT Operations to apply forthcoming vendor patches provided by IBM for the affected LTS and CD branches.
]]>highadvisoryvulnerabilityrcedosmessaging