IBM Mq Operator vulnerabilities

14 CVEs affecting IBM Mq Operator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2607, published 2026-05-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-39742, published 2024-07-08. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.
CVE-2024-39743, published 2024-07-08. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation. A remote attacker could exploit this…
CVE-2024-40681, published 2024-09-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue…
CVE-2025-27365, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client connecting to a MQ…
CVE-2025-36041, published 2025-06-15. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR…
CVE-2025-1333, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through…
CVE-2024-27255, published 2024-03-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms…
CVE-2024-27256, published 2025-01-27. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weaker than expected cryptographic…
CVE-2025-36005, published 2025-07-24. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could…
CVE-2024-40680, published 2024-09-07. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault.

Latest

CVE-2026-2607, published 2026-05-27. Medium severity, CVSS 5.1. EPSS: 0.1% chance of exploitation in the next 30 days. IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied…
CVE-2025-12755, published 2026-02-17. Medium severity, CVSS 4.0. EPSS: 0.1% chance of exploitation in the next 30 days. IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x–9.4.x releases) contain a vulnerability where log messages…
CVE-2025-33013, published 2025-07-24. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose…