IBM Mq Appliance vulnerabilities

49 CVEs affecting IBM Mq Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-10747, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4682, published 2021-01-28. Critical severity, CVSS 9.8. EPSS: 7.2% chance of exploitation in the next 30 days. IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit…
CVE-2017-1318, published 2017-07-18. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system, caused by command execution. IBM X-Force ID: 125730.
CVE-2019-4055, published 2019-04-19. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function. IBM X-Force ID: 156564.
CVE-2020-4465, published 2020-07-28. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an error within the channel processing code. A remote attacker…
CVE-2020-4869, published 2021-01-11. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. A remote attacker could send a specially crafted SNMP query to cause the appliance to reload.…
CVE-2019-4614, published 2020-01-28. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by converting an invalid message. IBM X-Force ID: 168639.
CVE-2020-4375, published 2020-07-28. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of service due to a memory leak caused by an error creating a dynamic queue. IBM…
CVE-2019-4656, published 2020-03-16. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and require a restart due…
CVE-2023-46177, published 2023-12-18. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. IBM MQ Appliance 9.3 LTS and 9.3 CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.…
CVE-2020-4267, published 2020-04-24. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak. IBM X-Force ID: 175840.

Latest

CVE-2026-10747, published 2026-09-18. Critical severity, CVSS 10.0. EPSS: 0.6% chance of exploitation in the next 30 days. IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.
CVE-2025-14456, published 2026-03-03. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ Appliance 9.4 CD through 9.4.4.0 to 9.4.4.1
CVE-2025-3631, published 2025-07-11. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it.
CVE-2025-23225, published 2025-02-28. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to cause a denial of service due to the improper handling of invalid headers sent to the queue.
CVE-2025-0975, published 2025-02-28. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.
CVE-2024-54173, published 2025-02-28. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
CVE-2024-51471, published 2024-12-19. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ Appliance 9.3 LTS, 9.3 CD, and 9.4 LTS web console could allow an authenticated user to cause a denial-of-service when trace is enabled due to information being written into memory outside of…
CVE-2024-51470, published 2024-12-18. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a…
CVE-2024-25048, published 2024-04-27. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM MQ Appliance 9.3 CD and LTS are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated attacker could overflow a buffer and execute arbitrary code…
CVE-2024-25016, published 2024-03-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Force ID: 281279.