Login Request a demo
MQ
Product
MQ
by IBM · last CVE Oct 19, 2026
74
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities74In the news0Timeline
Severity mix
Critical 4High 35Medium 34Low 1
Severity
All severities74Critical4High35Medium34Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add MQ to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-11725
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to privilege escalation
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11378
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11375
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-10853
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-10575
8.8
0%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12728
8.8
1%
Sep 15
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13293
8.8
1%
Sep 14
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2024-31912
8.8
0%
Jun 28
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment
Affected: 9.3.0; 9.3.0
CVE-2026-11729
8.5
1%
Sep 15
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11728
8.1
0%
Sep 15
IBM MQ .NET client is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12355
8.1
1%
Sep 15
IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12666
8.1
0%
Sep 15
IBM MQ Java messaging is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2018-1998
7.8
0%
Mar 11
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges
Affected: 9.0.0.1; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +12 more
CVE-2026-10751
7.5
1%
Sep 18
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12354
7.5
0%
Sep 15
IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2025-36128
7.5
1%
Oct 16
IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations
Affected: 9.1.0.0; 9.2.0.0; 9.3.0; 9.3.0.0; 9.4.0; 9.4.0.0
CVE-2024-35116
7.5
1%
Jun 28
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes
Affected: 9.0.0.0 before 9.0.0.26; 9.1.0.0 before 9.1.0.22; 9.2.0.0 before 9.2.0.26; 9.3.0.0 before 9.3.0.20; 9.3.0.0 before 9.4.0.0
CVE-2024-31919
7.5
0%
Jun 28
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API…
Affected: 9.0.0.0; 9.1.0.0; 9.2.0; 9.3.0; 9.3.0
CVE-2024-25015
7.5
1%
May 1
IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources
Affected: 9.2.0.0 before 9.2.0.25; 9.3.0 before 9.3.5; 9.3.0.0 before 9.3.0.17
CVE-2024-25016
7.5
1%
Mar 3
IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic
Affected: 9.0.0.0 before 9.0.0.23; 9.1.0.0 before 9.1.0.20; 9.2.0 before 9.2.0.22; 9.3.0 before 9.3.0.16
CVE-2023-28513
7.5
1%
Jul 19
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial…
Affected: 9.0.0.0; 9.1.0.0; 9.2.0; 9.2.0; 9.3.0; 9.3.0
CVE-2021-39034
7.5
1%
Feb 17
IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process
Affected: 9.1.0.0 through 9.1.0.9
CVE-2020-4870
7.5
2%
Dec 21
IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications
Affected: 9.2.0; 9.2.0
CVE-2020-4310
7.5
2%
Jun 16
IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic
Affected: 8.0.0.0 before 8.0.0.15; 9.0.0.0 before 9.0.0.10; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.5
CVE-2019-4762
7.5
2%
Apr 16
IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error in the Channel processing function
Affected: 9.0.0.0 before 9.0.0.9; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.3
CVE-2019-4055
7.5
2%
Apr 19
IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function
Affected: 8.0.0.0 through 8.0.0.10; 9.0.0.0 through 9.0.0.5; 9.1.0 through 9.1.1; 9.1.0.0 through 9.1.0.1
CVE-2018-1974
7.5
1%
Mar 11
IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels
Affected: 9.0.0.1; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +14 more
CVE-2018-1883
7.5
2%
Dec 7
A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into…
Affected: 9.0.2 through 9.0.5; 9.1.0.0
CVE-2019-4227
7.3
1%
Oct 4
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to…
Affected: 8.0.0.4 through 8.0.0.12; 9.0.0.0 through 9.0.0.6; 9.1.0 through 9.1.2; 9.1.0.0 through 9.1.0.2
CVE-2026-10030
7.1
0%
Sep 18
IBM MQ Console is vulnerable to privilege escalation
Affected: 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; 10.0.0.0
CVE-2026-12667
7.1
0%
Sep 15
IBM MQ .NET client is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13275
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13285
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13287
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12150
7.0
0%
Sep 15
IBM MQ queue manager is vulnerable to denial of service
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
Showing 35