{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mq/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-11725"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","ibm-mq"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ contains a critical integer overflow vulnerability, identified as CVE-2026-11725, affecting its processing of MQINQ requests. This vulnerability allows an authenticated attacker with access to the messaging system to manipulate input parameters during the MQINQ call sequence, causing a buffer or memory handling error. The impact of successful exploitation ranges from an immediate denial of service (DoS), causing the queue manager to crash or hang, to the potential for remote arbitrary code execution under the context of the IBM MQ service account. Given the privileged nature of message queuing middleware in enterprise environments, this flaw represents a significant risk for lateral movement or infrastructure disruption. Organizations utilizing IBM MQ should prioritize identifying the patch status of their queue managers and implementing access controls to restrict the ability of unauthorized or untrusted users to perform administrative or inquiries on the messaging infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11725 can lead to a complete service disruption of the IBM MQ messaging backbone, affecting all downstream applications that rely on the queue manager. In scenarios resulting in arbitrary code execution, an attacker may gain persistence on the underlying server, potentially accessing sensitive business messages or pivoting into the internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification and patching of all IBM MQ instances. Review IBM security bulletins for the specific version-dependent fixed releases. Audit MQ queue manager access controls to ensure that only authorized service accounts and administrators can invoke MQINQ functions, limiting the potential attack surface.\u003c/p\u003e\n","date_modified":"2026-09-18T22:08:22Z","date_published":"2026-09-18T22:08:22Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11725/","summary":"An integer overflow vulnerability in IBM MQ's processing of MQINQ requests allows an authenticated attacker to trigger a denial of service or potentially execute arbitrary code.","title":"Integer Overflow Vulnerability in IBM MQ Request Processing (CVE-2026-11725)","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11725/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-11381"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","cve","middleware"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ is susceptible to a vulnerability tracked as CVE-2026-11381, which arises from improper validation of message distribution list structures. An attacker who has already gained authentication to the system can exploit this flaw by submitting crafted message distribution lists. Successful exploitation of this vulnerability enables the attacker to disrupt the availability of the MQ service, resulting in a denial of service (DoS), or potentially execute arbitrary code with the privileges of the MQ service process. Given the role of IBM MQ as a middleware for message-oriented communication, compromise of the service could lead to significant operational disruption or privilege escalation on the hosting system. Organizations running IBM MQ should evaluate their current patch levels and prioritize applying updates provided by IBM to remediate this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11381 leads to denial of service or arbitrary code execution, impacting the availability and integrity of messaging middleware infrastructure. This vulnerability targets enterprise messaging environments, which are often central to backend communication between disparate business applications. Unauthorized execution of code could allow an attacker to pivot into internal segments, access sensitive data in transit, or compromise system-level assets integrated with the messaging bus.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReview IBM security bulletins for the specific patches addressing CVE-2026-11381 across all supported IBM MQ versions.\u003c/li\u003e\n\u003cli\u003eImplement strict access control lists for the messaging environment to ensure only authorized entities can submit messages or interact with distribution lists.\u003c/li\u003e\n\u003cli\u003eEnable auditing for administrative and message-processing operations within IBM MQ to identify abnormal structure submissions or service instability.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-18T18:08:13Z","date_published":"2026-09-18T18:08:13Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11381/","summary":"IBM MQ contains a vulnerability in the validation of message distribution list structures that allows an authenticated attacker to trigger a denial of service or potentially execute arbitrary code.","title":"IBM MQ Improper Validation Vulnerability (CVE-2026-11381)","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-11381/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-11375"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","denial-of-service"],"_cs_type":"threat","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ, a message-oriented middleware solution, contains a critical security vulnerability identified as CVE-2026-11375. The flaw originates from improper handling of XA (eXtended Architecture) transaction identifiers during processing. An authenticated attacker can exploit this buffer overflow condition by submitting specially crafted transaction identifiers to the message queuing service.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation results in memory corruption, which can lead to the instability of the MQ process, resulting in a denial of service (DoS), or potentially allow for arbitrary code execution in the context of the service. Due to the high CVSS v3.1 score of 8.8, this vulnerability poses a significant risk to the integrity and availability of messaging infrastructure. Organizations utilizing IBM MQ should evaluate their exposure and prioritize patching to mitigate the risk of exploitation by authenticated malicious actors.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-11375 enables authenticated attackers to disrupt core messaging services via DoS or gain unauthorized execution capabilities on the host system. This vulnerability affects enterprise environments relying on IBM MQ for transactional data exchange, potentially leading to service outages or lateral movement following code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification of IBM MQ instances within the network environment and apply security updates provided by IBM as soon as they become available. Given the authentication requirement, implement strict access controls on the MQ interface to minimize the number of users capable of interacting with the service.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-11375 immediately upon the release of security updates from IBM.\u003c/li\u003e\n\u003cli\u003eMonitor MQ service logs for frequent restarts or crashes that could indicate DoS attempts.\u003c/li\u003e\n\u003cli\u003eAudit access lists for the MQ interface to ensure only authorized users have connectivity, as the exploit requires authenticated access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:07:59Z","date_published":"2026-09-18T18:07:59Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-overflow/","summary":"IBM MQ is vulnerable to a stack buffer overflow triggered by malicious XA transaction identifiers, allowing an authenticated attacker to cause a denial of service or achieve arbitrary code execution.","title":"Stack Buffer Overflow in IBM MQ XA Transaction Processing","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-10853"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ contains a security vulnerability, identified as CVE-2026-10853, originating from improper validation of cluster command message lengths. The flaw resides within the component responsible for processing cluster-related communications. An authenticated attacker who has successfully gained access to the cluster environment can exploit this validation failure by sending specially crafted command messages. Successful exploitation permits the attacker to trigger a service crash, resulting in a denial of service (DoS), or potentially achieve remote code execution (RCE) on the underlying host. Given the severity of this vulnerability, which carries a CVSS v3.1 base score of 7.5, organizations deploying IBM MQ in clustered configurations are advised to prioritize security updates to mitigate the risk of unauthorized command execution or system instability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-10853 allows an attacker to disrupt critical messaging middleware, leading to service downtime, or potentially gain control over the affected IBM MQ server instance. This impacts enterprise environments that rely on IBM MQ for high-availability messaging and integration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor IBM official security bulletins for the release of patches addressing CVE-2026-10853.\u003c/li\u003e\n\u003cli\u003eApply security patches to all affected IBM MQ instances in clustered environments immediately upon release.\u003c/li\u003e\n\u003cli\u003eReview and restrict cluster membership and administrative access to authorized personnel only, minimizing the pool of potentially malicious authenticated actors.\u003c/li\u003e\n\u003cli\u003eEnsure logging is enabled for IBM MQ cluster command traffic to detect anomalies in message lengths or unusual command patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:07:53Z","date_published":"2026-09-18T18:07:53Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-rce-dos/","summary":"IBM MQ contains a vulnerability (CVE-2026-10853) where improper cluster command message length validation allows authenticated attackers to cause a denial of service or remote code execution.","title":"Vulnerability in IBM MQ Cluster Command Message Validation","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-rce-dos/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-10027"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM MQ, a message-oriented middleware used for enterprise application integration, contains a critical memory corruption vulnerability identified as CVE-2026-10027. The vulnerability exists within the software's handling of compressed data on channels where compression is explicitly enabled. An unauthenticated remote attacker can exploit this flaw by sending specially crafted, malformed compressed data packets to a listening channel. Successful exploitation of this buffer overflow condition allows the attacker to crash the target IBM MQ process, resulting in a denial of service, or potentially achieve arbitrary code execution under the privileges of the MQ service. This impact is significant for organizations relying on IBM MQ for core business messaging, as it compromises both the availability and integrity of communication infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 base score of 8.1, reflecting its potential for remote code execution. If exploited, an attacker could disrupt critical enterprise messaging services, leading to system-wide data transit outages, or gain unauthorized control over affected message queue managers, facilitating further lateral movement or data exfiltration within the organization's internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security operations and IT teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM MQ across the enterprise and verify if channel compression is enabled.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided security patches for CVE-2026-10027 to all IBM MQ installations immediately upon release.\u003c/li\u003e\n\u003cli\u003eIn environments where patching is delayed, consider disabling channel compression as a temporary mitigation to prevent the trigger for this specific buffer overflow.\u003c/li\u003e\n\u003cli\u003eReview network configurations to restrict access to IBM MQ listener ports to authorized endpoints only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T18:07:28Z","date_published":"2026-09-18T18:07:28Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-buffer-overflow/","summary":"IBM MQ is vulnerable to a buffer overflow during the processing of malformed compressed data, which can be leveraged by a remote attacker for denial of service or arbitrary code execution.","title":"Buffer Overflow Vulnerability in IBM MQ","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-buffer-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*","cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:*:*","cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*","cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:*:*","cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*","cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:partner_center:-:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2024-49033"},{"cvss":8.7,"id":"CVE-2024-49035"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MQ"],"_cs_severities":["high"],"_cs_tags":["vulnerability","messaging-middleware","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM has disclosed multiple security vulnerabilities affecting the IBM MQ messaging software. These flaws, tracked as CVE-2024-49033, CVE-2024-49034, and CVE-2024-49035, present significant risks to systems running the software. Successful exploitation of these vulnerabilities may allow an unauthenticated or authenticated attacker to achieve arbitrary remote code execution (RCE) on the underlying host, trigger a Denial of Service (DoS) condition, gain access to sensitive information, or perform unauthorized data manipulation. Defenders should prioritize patching and configuration reviews for all instances of IBM MQ, as these vulnerabilities impact the integrity and availability of messaging infrastructure, which often serves as a critical backbone for enterprise applications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation could result in the total compromise of the host system, loss of message confidentiality, and disruption of critical business services that rely on IBM MQ for communication. These vulnerabilities affect all deployments of the software, and organizations should apply vendor-provided security updates to mitigate these risks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all IBM MQ deployments across the environment using asset inventory systems.\u003c/li\u003e\n\u003cli\u003eReview the IBM security advisory for the specific fixed versions associated with CVE-2024-49033, CVE-2024-49034, and CVE-2024-49035.\u003c/li\u003e\n\u003cli\u003eApply the latest security patches provided by IBM to all MQ instances.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to limit access to MQ listener ports (typically 1414) to authorized clients only to reduce the attack surface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-15T13:04:36Z","date_published":"2026-09-15T13:04:36Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-vulnerabilities/","summary":"IBM MQ is affected by multiple vulnerabilities, including CVE-2024-49033, CVE-2024-49034, and CVE-2024-49035, which could allow a remote attacker to execute arbitrary code, cause a denial of service, disclose sensitive information, or manipulate data.","title":"Multiple Vulnerabilities in IBM MQ","url":"https://feed.craftedsignal.io/briefs/2026-09-ibm-mq-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - MQ","version":"https://jsonfeed.org/version/1.1"}