CVE-2026-11729

HIGHCVSS 8.5

Description

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code in client applications due to unsafe deserialization that enables JNDI injection attacks.

Timeline

Published:September 15th, 2026 6:17 PM

Last modified:September 16th, 2026 7:21 PM

CVSS Scoring

CVSS v3: 8.5 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502

References & Reports

Advisories, patches, and third-party reports

https://www.ibm.com/support/pages/node/7284941

Source: NIST NVD · Data may lag official sources by up to one minute