Executive brief
IBM MQ is an enterprise message-oriented middleware platform used to reliably exchange data between applications and systems. A Java deserialization vulnerability in the MQ Java client allows authenticated attackers to execute arbitrary code within client applications through JNDI injection, potentially compromising client workstations and data integrity across connected systems.
Technical details
The vulnerability is a Java deserialization flaw (CWE-502) in the IBM MQ Java client's internal command manager that enables JNDI injection attacks. An authenticated attacker with access to the messaging network can craft malicious serialized objects that, when deserialized by a client application, execute arbitrary code. The attack requires network access to MQ and valid credentials but no user interaction. This affects the Java messaging component across multiple IBM MQ versions. Patches are available through cumulative security updates for supported LTS versions (9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26) and upgrade to 10.0.0.5 for CD releases.
Affected products
- IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0
Timeline
- 2026-09-15: disclosed: CVE-2026-11729 published
- 2026-09-14: patched: IBM security bulletin released with fixes: MQ 9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26, and 10.0.0.5