IBM Supplied Mq Advanced Container Images vulnerabilities

9 CVEs affecting IBM Supplied Mq Advanced Container Images, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2607, published 2026-05-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-40681, published 2024-09-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue…
CVE-2025-27365, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client connecting to a MQ…
CVE-2025-36041, published 2025-06-15. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR…
CVE-2025-1333, published 2025-05-01. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through…
CVE-2024-27256, published 2025-01-27. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weaker than expected cryptographic…
CVE-2025-36005, published 2025-07-24. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could…
CVE-2025-33013, published 2025-07-24. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose…
CVE-2026-2607, published 2026-05-27. Medium severity, CVSS 5.1. EPSS: 0.1% chance of exploitation in the next 30 days. IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied…
CVE-2025-12755, published 2026-02-17. Medium severity, CVSS 4.0. EPSS: 0.1% chance of exploitation in the next 30 days. IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x–9.4.x releases) contain a vulnerability where log messages…