IBM Mq vulnerabilities

70 CVEs affecting IBM Mq, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11725, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4682, published 2021-01-28. Critical severity, CVSS 9.8. EPSS: 7.2% chance of exploitation in the next 30 days. IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit…
CVE-2018-1883, published 2018-12-07. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST…
CVE-2019-4261, published 2019-08-05. Medium severity, CVSS 6.5. EPSS: 2.4% chance of exploitation in the next 30 days. IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013.
CVE-2019-4055, published 2019-04-19. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function. IBM X-Force ID: 156564.
CVE-2020-4870, published 2020-12-21. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. IBM X-Force ID: 190833.
CVE-2022-22489, published 2022-08-19. Critical severity, CVSS 9.1. EPSS: 1.7% chance of exploitation in the next 30 days. IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to…
CVE-2019-4762, published 2020-04-16. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error in the Channel processing function. IBM X-Force ID: 173625.
CVE-2020-4310, published 2020-06-16. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.
CVE-2019-4614, published 2020-01-28. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by converting an invalid message. IBM X-Force ID: 168639.
CVE-2019-4656, published 2020-03-16. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and require a restart due…

Latest

CVE-2026-11725, published 2026-09-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.
CVE-2026-11378, published 2026-09-18. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.
CVE-2026-11375, published 2026-09-18. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.
CVE-2026-10853, published 2026-09-18. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
CVE-2026-10751, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.
CVE-2026-10575, published 2026-09-18. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution…
CVE-2026-10030, published 2026-09-18. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.
CVE-2026-10027, published 2026-09-18. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression…
CVE-2026-12728, published 2026-09-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0…
CVE-2026-12667, published 2026-09-15. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0…