Login Request a demo
MQ
Product
MQ
by IBM · last CVE Oct 19, 2026
74
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities74In the news0Timeline
Severity mix
Critical 4High 35Medium 34Low 1
Severity
All severities74Critical4High35Medium34Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add MQ to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-10027
9.8
1%
Sep 18
IBM MQ queue manager is vulnerable to unauthenticated remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12351
9.8
1%
Sep 15
IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection
Affected: 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 LTS; 10.0.0.0
CVE-2020-4682
9.8
8%
Jan 28
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +30 more
CVE-2022-22489
9.1
2%
Aug 19
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
Affected: 8.0.0.0; 9.0.0.0; 9.1.0; 9.1.0.0; 9.2.0; 9.2.0
CVE-2026-11725
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to privilege escalation
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11378
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11375
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-10853
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-10575
8.8
0%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12728
8.8
1%
Sep 15
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13293
8.8
1%
Sep 14
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2024-31912
8.8
0%
Jun 28
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment
Affected: 9.3.0; 9.3.0
CVE-2026-11729
8.5
1%
Sep 15
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11728
8.1
0%
Sep 15
IBM MQ .NET client is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12355
8.1
1%
Sep 15
IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12666
8.1
0%
Sep 15
IBM MQ Java messaging is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2018-1998
7.8
0%
Mar 11
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges
Affected: 9.0.0.1; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +12 more
CVE-2026-10751
7.5
1%
Sep 18
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12354
7.5
0%
Sep 15
IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2025-36128
7.5
1%
Oct 16
IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations
Affected: 9.1.0.0; 9.2.0.0; 9.3.0; 9.3.0.0; 9.4.0; 9.4.0.0
CVE-2024-35116
7.5
1%
Jun 28
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes
Affected: 9.0.0.0 before 9.0.0.26; 9.1.0.0 before 9.1.0.22; 9.2.0.0 before 9.2.0.26; 9.3.0.0 before 9.3.0.20; 9.3.0.0 before 9.4.0.0
CVE-2024-31919
7.5
0%
Jun 28
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API…
Affected: 9.0.0.0; 9.1.0.0; 9.2.0; 9.3.0; 9.3.0
CVE-2024-25015
7.5
1%
May 1
IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources
Affected: 9.2.0.0 before 9.2.0.25; 9.3.0 before 9.3.5; 9.3.0.0 before 9.3.0.17
CVE-2024-25016
7.5
1%
Mar 3
IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic
Affected: 9.0.0.0 before 9.0.0.23; 9.1.0.0 before 9.1.0.20; 9.2.0 before 9.2.0.22; 9.3.0 before 9.3.0.16
CVE-2023-28513
7.5
1%
Jul 19
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial…
Affected: 9.0.0.0; 9.1.0.0; 9.2.0; 9.2.0; 9.3.0; 9.3.0
CVE-2021-39034
7.5
1%
Feb 17
IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process
Affected: 9.1.0.0 through 9.1.0.9
CVE-2020-4870
7.5
2%
Dec 21
IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications
Affected: 9.2.0; 9.2.0
CVE-2020-4310
7.5
2%
Jun 16
IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic
Affected: 8.0.0.0 before 8.0.0.15; 9.0.0.0 before 9.0.0.10; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.5
CVE-2019-4762
7.5
2%
Apr 16
IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error in the Channel processing function
Affected: 9.0.0.0 before 9.0.0.9; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.3
CVE-2019-4055
7.5
2%
Apr 19
IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function
Affected: 8.0.0.0 through 8.0.0.10; 9.0.0.0 through 9.0.0.5; 9.1.0 through 9.1.1; 9.1.0.0 through 9.1.0.1
CVE-2018-1974
7.5
1%
Mar 11
IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels
Affected: 9.0.0.1; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +14 more
CVE-2018-1883
7.5
2%
Dec 7
A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into…
Affected: 9.0.2 through 9.0.5; 9.1.0.0
CVE-2019-4227
7.3
1%
Oct 4
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to…
Affected: 8.0.0.4 through 8.0.0.12; 9.0.0.0 through 9.0.0.6; 9.1.0 through 9.1.2; 9.1.0.0 through 9.1.0.2
CVE-2026-10030
7.1
0%
Sep 18
IBM MQ Console is vulnerable to privilege escalation
Affected: 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; 10.0.0.0
CVE-2026-12667
7.1
0%
Sep 15
IBM MQ .NET client is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13275
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13285
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13287
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12150
7.0
0%
Sep 15
IBM MQ queue manager is vulnerable to denial of service
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13265
6.8
0%
Sep 14
IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-14511
6.5
0%
Oct 19
IBM MQ Denial of Service
Affected: 9.4.5.0 through 9.4.5.1
CVE-2024-51470
6.5
1%
Dec 18
IBM MQ denial of service
Affected: 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-35156
6.5
1%
Jun 28
IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser
Affected: 9.3.0.0 before 9.3.0.20; 9.3.0.0 before 9.4.0.0
CVE-2024-35155
6.5
1%
Jun 28
IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser
Affected: 9.3.0; 9.3.0
CVE-2022-31772
6.5
1%
Nov 11
IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels
Affected: 8.0.0.0; 9.0.0.0; 9.1.0; 9.1.0.0; 9.2.0; 9.2.0
CVE-2021-38875
6.5
1%
Nov 23
IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages
Affected: 8.0.0.0; 9.0.0.0; 9.1.0; 9.1.0.0; 9.2.0; 9.2.0
CVE-2020-4931
6.5
1%
Feb 24
IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages
Affected: 9.1.0; 9.1.0.0; 9.2.0.0
CVE-2020-4320
6.5
1%
Jun 16
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting
Affected: 8.0.0.0 before 8.0.0.15; 9.0.0.0 before 9.0.0.10; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.5
CVE-2020-4267
6.5
1%
Apr 24
IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak
Affected: 8.0.0.0 before 8.0.0.14; 9.1.0.0 before 9.1.0.4
CVE-2019-4656
6.5
1%
Mar 16
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and…
Affected: 8.0.0.0 before 8.0.0.14; 9.0.0.0 through 9.0.0.9; 9.1.0 before 9.1.4; 9.1.0.0 before 9.1.0.4
Page 1 of 2 · 74 total
12