# IBM Mq vulnerabilities Source: https://junglewise.ai/threats/technologies/mq Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mq.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 46 vulnerabilities in IBM Mq: 0 in the last 7 days and 46 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-18142, was published on 4 November 2026. 24 vulnerabilities in the last four weeks, up 9% on the four before (22). 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 24 - Last 90 days: 46 - All time: 46 (1 critical, 0 exploited in the wild) ## About IBM Mq IBM middleware service for asynchronous messaging and enterprise integration. ## Latest IBM Mq vulnerabilities - [CVE-2026-18142: IBM MQ integer overflow in malformed MQINQ request](https://junglewise.ai/threats/cve-2026-18142-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 7.1, published 4 Nov 2026) - [CVE-2026-14252: IBM MQ password disclosure in log files](https://junglewise.ai/threats/cve-2026-14252-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (medium, CVSS 6.2, published 4 Nov 2026) - [CVE-2026-13292: IBM MQ Managed File Transfer arbitrary code execution via environment variables](https://junglewise.ai/threats/cve-2026-13292-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 8.8, published 4 Nov 2026) - [CVE-2026-13289: IBM MQ XML external entity injection in Managed File Transfer](https://junglewise.ai/threats/cve-2026-13289-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 7.1, published 4 Nov 2026) - [CVE-2026-13284: IBM MQ XML external entity injection in Managed File Transfer](https://junglewise.ai/threats/cve-2026-13284-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 7.1, published 4 Nov 2026) - [CVE-2026-13271: IBM MQ Managed File Transfer XXE in command queue processing](https://junglewise.ai/threats/cve-2026-13271-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 8.1, published 4 Nov 2026) - [CVE-2026-12550: IBM MQ heap buffer overflow in message selection validation](https://junglewise.ai/threats/cve-2026-12550-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (medium, CVSS 5.4, published 4 Nov 2026) - [CVE-2026-12356: IBM MQ code injection in Managed File Transfer](https://junglewise.ai/threats/cve-2026-12356-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 7.5, published 4 Nov 2026) - [CVE-2026-11724: IBM MQ arbitrary code execution in Managed File Transfer](https://junglewise.ai/threats/cve-2026-11724-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 8.5, published 4 Nov 2026) - [CVE-2026-11376: IBM MQ integer overflow in subscription request processing](https://junglewise.ai/threats/cve-2026-11376-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 8.8, published 4 Nov 2026) - [CVE-2026-10859: IBM MQ arbitrary code execution in ObjectMessage deserialization](https://junglewise.ai/threats/cve-2026-10859-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 7.5, published 4 Nov 2026) - [CVE-2026-14511: IBM MQ C client library denial of service](https://junglewise.ai/threats/cve-2026-14511-ibm-mq-9-4-5-0-through-9-4-5-1-could-allow-an-authenticated-user) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-12727: IBM MQ off-by-one buffer overflow in object name processing](https://junglewise.ai/threats/cve-2026-12727-ibm-mq-could-allow-an-authenticated-attacker-to-cause-potential) (medium, CVSS 4.3, published 19 Oct 2026) - [CVE-2026-12670: IBM MQ denial of service in character set conversion](https://junglewise.ai/threats/cve-2026-12670-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (medium, CVSS 5.3, published 19 Oct 2026) - [CVE-2026-12665: IBM MQ stack buffer overflow in TLS certificate processing](https://junglewise.ai/threats/cve-2026-12665-ibm-mq-could-allow-a-remote-attacker-to-execute-arbitrary-code) (high, CVSS 8.1, published 19 Oct 2026) - [CVE-2026-12350: IBM MQ denial of service in asynchronous consume request](https://junglewise.ai/threats/cve-2026-12350-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-12343: IBM MQ denial of service in RFH2 message header validation](https://junglewise.ai/threats/cve-2026-12343-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-12155: IBM MQ NULL pointer dereference in multicast status messages](https://junglewise.ai/threats/cve-2026-12155-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-11831: IBM MQ out-of-bounds read in request processing](https://junglewise.ai/threats/cve-2026-11831-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-limited) (medium, CVSS 5.4, published 19 Oct 2026) - [CVE-2026-11829: IBM MQ denial of service in MQOPEN request handling](https://junglewise.ai/threats/cve-2026-11829-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-11828: IBM MQ denial of service in asynchronous message consumption](https://junglewise.ai/threats/cve-2026-11828-ibm-mq-could-allow-a-remote-attacker-with-queue-manager-control) (medium, CVSS 5.9, published 19 Oct 2026) - [CVE-2026-10743: IBM MQ buffer overflow in MQOPEN operations](https://junglewise.ai/threats/cve-2026-10743-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-10574: IBM MQ heap buffer overflow in message handle properties](https://junglewise.ai/threats/cve-2026-10574-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-10572: IBM MQ heap buffer overflow in MQPUT operations](https://junglewise.ai/threats/cve-2026-10572-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-11725: IBM MQ integer overflow in MQINQ request](https://junglewise.ai/threats/cve-2026-11725-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 18 Sep 2026) ## Most severe IBM Mq vulnerabilities - [CVE-2026-12351: IBM MQ remote code execution via JNDI injection](https://junglewise.ai/threats/cve-2026-12351-ibm-mq-remote-code-execution-via-jndi-injection) (critical, CVSS 9.8, published 15 Sep 2026) - [CVE-2026-13293: IBM MQ Java deserialization remote code execution](https://junglewise.ai/threats/cve-2026-13293-ibm-mq-java-deserialization-remote-code-execution) (high, CVSS 8.8, published 14 Sep 2026) - [CVE-2026-11725: IBM MQ integer overflow in MQINQ request](https://junglewise.ai/threats/cve-2026-11725-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 18 Sep 2026) - [CVE-2026-12728: IBM MQ deserialization bypass remote code execution](https://junglewise.ai/threats/cve-2026-12728-ibm-mq-deserialization-bypass-remote-code-execution) (high, CVSS 8.8, published 15 Sep 2026) - [CVE-2026-11375: IBM MQ stack buffer overflow in XA transaction handling](https://junglewise.ai/threats/cve-2026-11375-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 18 Sep 2026) - [CVE-2026-11378: IBM MQ integer overflow in distribution list processing](https://junglewise.ai/threats/cve-2026-11378-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 18 Sep 2026) - [CVE-2026-10575: IBM MQ heap buffer overflow in MQPUT operations](https://junglewise.ai/threats/cve-2026-10575-ibm-mq-heap-buffer-overflow-in-mqput-operations) (high, CVSS 8.8, published 18 Sep 2026) - [CVE-2026-13292: IBM MQ Managed File Transfer arbitrary code execution via environment variables](https://junglewise.ai/threats/cve-2026-13292-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 8.8, published 4 Nov 2026) - [CVE-2026-11376: IBM MQ integer overflow in subscription request processing](https://junglewise.ai/threats/cve-2026-11376-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts) (high, CVSS 8.8, published 4 Nov 2026) - [CVE-2026-10743: IBM MQ buffer overflow in MQOPEN operations](https://junglewise.ai/threats/cve-2026-10743-ibm-mq-could-allow-an-authenticated-attacker-to-cause-a-denial-of) (high, CVSS 8.8, published 19 Oct 2026) ## Vulnerabilities per week 24 vulnerabilities in the last four weeks, up 9% on the four before (22). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 22 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 13 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 11 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other IBM technologies - [IBM API Connect](https://junglewise.ai/threats/technologies/api-connect): 207 vulnerabilities - [IBM AIX](https://junglewise.ai/threats/technologies/aix): 181 vulnerabilities - [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss): 154 vulnerabilities - [IBM i](https://junglewise.ai/threats/technologies/i): 120 vulnerabilities - [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection): 93 vulnerabilities - [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios): 73 vulnerabilities - [IBM Vios](https://junglewise.ai/threats/technologies/vios): 72 vulnerabilities - [IBM WebSphere Application Server](https://junglewise.ai/threats/technologies/websphere-application-server): 67 vulnerabilities - [IBM WebSphere Application Server Liberty](https://junglewise.ai/threats/technologies/websphere-application-server-liberty): 56 vulnerabilities - [IBM Verify Identity Access](https://junglewise.ai/threats/technologies/verify-identity-access): 50 vulnerabilities - [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data): 48 vulnerabilities - [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager): 45 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "IBM Mq vulnerabilities", https://junglewise.ai/threats/technologies/mq, 12 November 2026.