CVE-2026-11378 – IBM MQ

This IBM MQ update fixes twelve vulnerabilities across queue managers, the MQ Console, and the Java and JMS client libraries. The most serious, CVE-2026-12351, has a CVSS score of 9.8, Critical severity. It lets a remote attacker run arbitrary code through unsafe JNDI lookup processing when the IVT application is deployed. CVE-2026-10575, CVE-2026-11375, CVE-2026-11378, CVE-2026-11725, and CVE-2026-13293 each have a CVSS score of 8.8, High severity. They cover heap and stack buffer overflows, integer overflows in distribution list and MQINQ processing, and unsafe deserialization that lets authenticated attackers execute code or crash the service.

CVE-2026-11729 has a CVSS score of 8.5, High severity, and enables JNDI injection against client applications. CVE-2026-10027 and CVE-2026-11728 each have a CVSS score of 8.1, High severity. They cover a buffer overflow in compressed channel data and a client-side heap overflow triggered by a malicious queue manager or a man-in-the-middle attacker. CVE-2026-10751 has a CVSS score of 7.5, High severity, and fixes a deserialization filter bypass in the Java and JMS clients. CVE-2026-10030 has a CVSS score of 7.1, High severity, and stops non-administrative Console users from creating and starting queue managers. CVE-2026-12150 has a CVSS score of 7.0, High severity, and fixes improper handling of deeply nested TLS certificate data. Affected releases span the 9.1, 9.2, 9.3, and 9.4 LTS and CD streams and 10.0.0.0.