IBM Mq For HPE Nonstop vulnerabilities

13 CVEs affecting IBM Mq For HPE Nonstop, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11727, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4466, published 2020-07-20. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within the Queue processing function. IBM X-Force ID: 181563.
CVE-2020-4376, published 2020-07-01. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service caused by an error within the pubsub logic. IBM X-Force ID: 179081.
CVE-2024-51470, published 2024-12-18. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a…
CVE-2022-40237, published 2023-02-27. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM MQ for HPE NonStop 8.1.0 is vulnerable to a denial of service attack due to an error within the CCDT and channel synchronization logic. IBM X-Force ID: 235727.
CVE-2026-11727, published 2026-09-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue…
CVE-2026-10858, published 2026-09-18. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing…
CVE-2026-11381, published 2026-09-18. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.
CVE-2026-11716, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper…
CVE-2026-11726, published 2026-09-18. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset…
CVE-2020-4352, published 2020-05-29. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when running in restricted mode. IBM X-Force ID: 178427.

Latest

CVE-2026-10744, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer overflow in MQINQ request…
CVE-2022-22325, published 2022-05-13. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a local user from a stack trace. IBM X-Force ID: 218853.
CVE-2021-38950, published 2021-12-14. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-ForceID: 211404.