Critical severity · published Jul 8, 2024
CVE-2024-39742
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MQ Operator · Ibm
2.0.0 before 2.0.24; 2.2.0 through 2.2.2; 2.3.0 through 2.3.3; 2.4.0 through 2.4.8; 3.1.0 through 3.1.3; 3.2.0 before 3.2.2; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39742
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/297169
Vendor Advisory
https://www.ibm.com/support/pages/node/7159714
More from MQ Operator
9.8
CVE-2026-12665
IBM MQ Buffer Overflow
9.8
CVE-2025-36041
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through…
8.8
CVE-2026-10572
IBM MQ Buffer Overflow
8.8
CVE-2026-10574
IBM MQ Buffer Overflow
8.8
CVE-2026-10743
IBM MQ Race Condition