Quick answers
- Is CVE-2026-14252 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14252 being exploited in the wild.
- How severe is CVE-2026-14252?
- Medium severity, with a CVSS score of 6.2, published 4 November 2026.
- Which products and versions are affected?
- IBM Mq 10.0.0.0 through 10.0.0.5 LTS and CD.
- Is there a fix for CVE-2026-14252?
- Yes: fixed in IBM MQ 9.2.0.46 LTS, 9.3.0.43 LTS, 9.4.0.30 LTS, 10.0.0.6 LTS, 10.0.1.0 CD. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14252 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-14252?
- Check whether you run IBM Mq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: IBM MQ 9.2.0.46 LTS, 9.3.0.43 LTS, 9.4.0.30 LTS, 10.0.0.6 LTS, 10.0.1.0 CD
Technical details
IBM MQ's runmqccred utility inserts sensitive information, including passwords, into log files accessible to unprivileged local users (CWE-532). The vulnerability requires local access to the affected system and no authentication to MQ itself. An attacker with local user privileges can read the log files and extract credentials for further attack.
Affected products
- IBM MQ 9.2.0.0 through 9.2.0.44 LTS
- IBM MQ 9.3.0.0 through 9.3.0.42 LTS
- IBM MQ 9.4.0.0 through 9.4.0.26 LTS
- IBM MQ 9.4.0.0 through 9.4.5.1 CD
- IBM MQ 10.0.0.0 through 10.0.0.5 LTS and CD
Timeline
- 2026-10-29: disclosed