Critical severity · published Jan 28, 2021
CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
9.8
CVSS
7.6%
EPSS
No
On KEV
Description
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.6% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MQ
MQ · Ibm
8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +30 more · source: NVD
MA
MQ Appliance · Ibm
9.2.0.0 · source: NVD
WM
Websphere MQ · Ibm
7.5.0.0; 7.5.0.1; 7.5.0.2; 7.5.0.3; 7.5.0.4; 7.5.0.5; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-4682
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-4682
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/186509
Patch
https://www.ibm.com/support/pages/node/6408626
More from MQ
9.8
CVE-2026-10027
IBM MQ queue manager is vulnerable to unauthenticated remote code execution
9.8
CVE-2026-12351
IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection
9.1
CVE-2022-22489
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
8.8
CVE-2026-11725
IBM MQ queue manager is vulnerable to privilege escalation
8.8
CVE-2026-11378
IBM MQ queue manager is vulnerable to remote code execution