CVE Daily – IBM MQ (High+Critical) https://cvedaily.com/pages/tags/ibm-mq.html CVE Daily – IBM MQ (High+Critical) en Wed, 03 Jun 2026 21:26:42 +0000 [High] CVE-2025-36128 – IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of servi... https://nvd.nist.gov/vuln/detail/CVE-2025-36128 https://nvd.nist.gov/vuln/detail/CVE-2025-36128 Thu, 16 Oct 2025 17:15:33 +0000 High CVE-2025-36128

IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.

CVSS: 7.5 · CWE: CWE-772

View on NVD

]]> [High] CVE-2025-0975 – IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated... https://nvd.nist.gov/vuln/detail/CVE-2025-0975 https://nvd.nist.gov/vuln/detail/CVE-2025-0975 Fri, 28 Feb 2025 03:15:10 +0000 High CVE-2025-0975

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.

CVSS: 8.8 · CWE: CWE-150

View on NVD

]]> [High] CVE-2024-40681 – IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an aut... https://nvd.nist.gov/vuln/detail/CVE-2024-40681 https://nvd.nist.gov/vuln/detail/CVE-2024-40681 Sat, 07 Sep 2024 15:15:10 +0000 High CVE-2024-40681

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.

CVSS: 7.5 · CWE: CWE-266

View on NVD

]]> [High] CVE-2024-39742 – IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass au... https://nvd.nist.gov/vuln/detail/CVE-2024-39742 https://nvd.nist.gov/vuln/detail/CVE-2024-39742 Mon, 08 Jul 2024 14:15:02 +0000 High CVE-2024-39742

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.

CVSS: 8.1 · CWE: CWE-187

View on NVD

]]> [High] CVE-2024-31912 – IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their pr... https://nvd.nist.gov/vuln/detail/CVE-2024-31912 https://nvd.nist.gov/vuln/detail/CVE-2024-31912 Fri, 28 Jun 2024 18:15:03 +0000 High CVE-2024-31912

IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. IBM X-Force ID: 289894.

CVSS: 7.5 · CWE: CWE-266

View on NVD

]]> [High] CVE-2024-25015 – IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user... https://nvd.nist.gov/vuln/detail/CVE-2024-25015 https://nvd.nist.gov/vuln/detail/CVE-2024-25015 Wed, 01 May 2024 17:15:29 +0000 High CVE-2024-25015

IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. IBM X-Force ID: 281278.

CVSS: 7.5 · CWE: CWE-406

View on NVD

]]> [High] CVE-2024-25048 – IBM MQ Appliance 9.3 CD and LTS are vulnerable to a heap-based buffer overflow, ... https://nvd.nist.gov/vuln/detail/CVE-2024-25048 https://nvd.nist.gov/vuln/detail/CVE-2024-25048 Sat, 27 Apr 2024 12:15:10 +0000 High CVE-2024-25048

IBM MQ Appliance 9.3 CD and LTS are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. IBM X-Force ID: 283137.

CVSS: 7.5 · CWE: CWE-122

View on NVD

]]> [High] CVE-2024-25016 – IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remo... https://nvd.nist.gov/vuln/detail/CVE-2024-25016 https://nvd.nist.gov/vuln/detail/CVE-2024-25016 Sun, 03 Mar 2024 04:15:06 +0000 High CVE-2024-25016

IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Force ID: 281279.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2023-26284 – IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 c... https://nvd.nist.gov/vuln/detail/CVE-2023-26284 https://nvd.nist.gov/vuln/detail/CVE-2023-26284 Wed, 15 Mar 2023 18:15:10 +0000 High CVE-2023-26284

IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration access to the MQ console due to improper access controls. IBM X-Force ID: 248417.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Critical] CVE-2022-22489 – IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML E... https://nvd.nist.gov/vuln/detail/CVE-2022-22489 https://nvd.nist.gov/vuln/detail/CVE-2022-22489 Fri, 19 Aug 2022 19:15:07 +0000 Critical CVE-2022-22489

IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339.

CVSS: 9.1 · CWE: CWE-611

View on NVD

]]> [High] CVE-2021-39034 – IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue wi... https://nvd.nist.gov/vuln/detail/CVE-2021-39034 https://nvd.nist.gov/vuln/detail/CVE-2021-39034 Thu, 17 Feb 2022 17:15:09 +0000 High CVE-2021-39034

IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2021-38950 – IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation at... https://nvd.nist.gov/vuln/detail/CVE-2021-38950 https://nvd.nist.gov/vuln/detail/CVE-2021-38950 Tue, 14 Dec 2021 17:15:06 +0000 High CVE-2021-38950

IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-ForceID: 211404.

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2020-4938 – IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which c... https://nvd.nist.gov/vuln/detail/CVE-2020-4938 https://nvd.nist.gov/vuln/detail/CVE-2020-4938 Mon, 12 Jul 2021 16:15:08 +0000 High CVE-2020-4938

IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191815.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [Critical] CVE-2020-4682 – IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to ... https://nvd.nist.gov/vuln/detail/CVE-2020-4682 https://nvd.nist.gov/vuln/detail/CVE-2020-4682 Thu, 28 Jan 2021 13:15:12 +0000 Critical CVE-2020-4682

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

CVSS: 9.8 · CWE: CWE-502

View on NVD

]]> [High] CVE-2020-4766 – IBM MQ Internet Pass-Thru 2.1 and 9.2 could allow a remote user to cause a denia... https://nvd.nist.gov/vuln/detail/CVE-2020-4766 https://nvd.nist.gov/vuln/detail/CVE-2020-4766 Fri, 22 Jan 2021 17:15:12 +0000 High CVE-2020-4766

IBM MQ Internet Pass-Thru 2.1 and 9.2 could allow a remote user to cause a denial of service by sending malformed MQ data requests which would consume all available resources. IBM X-Force ID: 188093.

CVSS: 7.5 · CWE: CWE-400

View on NVD

]]> [High] CVE-2020-4870 – IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an ... https://nvd.nist.gov/vuln/detail/CVE-2020-4870 https://nvd.nist.gov/vuln/detail/CVE-2020-4870 Mon, 21 Dec 2020 18:15:16 +0000 High CVE-2020-4870

IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. IBM X-Force ID: 190833.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2020-4375 – IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could ... https://nvd.nist.gov/vuln/detail/CVE-2020-4375 https://nvd.nist.gov/vuln/detail/CVE-2020-4375 Tue, 28 Jul 2020 12:15:12 +0000 High CVE-2020-4375

IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of service due to a memory leak caused by an error creating a dynamic queue. IBM X-Force ID: 179080.

CVSS: 7.5 · CWE: CWE-401

View on NVD

]]> [High] CVE-2020-4310 – IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerabl... https://nvd.nist.gov/vuln/detail/CVE-2020-4310 https://nvd.nist.gov/vuln/detail/CVE-2020-4310 Tue, 16 Jun 2020 14:15:11 +0000 High CVE-2020-4310

IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2020-4352 – IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation at... https://nvd.nist.gov/vuln/detail/CVE-2020-4352 https://nvd.nist.gov/vuln/detail/CVE-2020-4352 Fri, 29 May 2020 13:15:09 +0000 High CVE-2020-4352

IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when running in restricted mode. IBM X-Force ID: 178427.

CVSS: 7.0 · CWE: N/A

View on NVD

]]> [High] CVE-2019-4762 – IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error i... https://nvd.nist.gov/vuln/detail/CVE-2019-4762 https://nvd.nist.gov/vuln/detail/CVE-2019-4762 Thu, 16 Apr 2020 16:15:13 +0000 High CVE-2019-4762

IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error in the Channel processing function. IBM X-Force ID: 173625.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2019-4620 – IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security... https://nvd.nist.gov/vuln/detail/CVE-2019-4620 https://nvd.nist.gov/vuln/detail/CVE-2019-4620 Tue, 28 Jan 2020 19:15:13 +0000 High CVE-2019-4620

IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment variables. IBM X-Force ID: 168863.

CVSS: 7.8 · CWE: CWE-20

View on NVD

]]> [High] CVE-2019-4227 – IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1... https://nvd.nist.gov/vuln/detail/CVE-2019-4227 https://nvd.nist.gov/vuln/detail/CVE-2019-4227 Fri, 04 Oct 2019 14:15:11 +0000 High CVE-2019-4227

IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. IBM X-Force ID: 159352.

CVSS: 7.3 · CWE: CWE-384

View on NVD

]]> [High] CVE-2019-4294 – IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 an... https://nvd.nist.gov/vuln/detail/CVE-2019-4294 https://nvd.nist.gov/vuln/detail/CVE-2019-4294 Tue, 20 Aug 2019 19:15:11 +0000 High CVE-2019-4294

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188.

CVSS: 7.8 · CWE: CWE-78

View on NVD

]]> [High] CVE-2019-4055 – IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9... https://nvd.nist.gov/vuln/detail/CVE-2019-4055 https://nvd.nist.gov/vuln/detail/CVE-2019-4055 Fri, 19 Apr 2019 17:29:01 +0000 High CVE-2019-4055

IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function. IBM X-Force ID: 156564.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [High] CVE-2017-1318 – IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrato... https://nvd.nist.gov/vuln/detail/CVE-2017-1318 https://nvd.nist.gov/vuln/detail/CVE-2017-1318 Tue, 18 Jul 2017 13:29:00 +0000 High CVE-2017-1318

IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system, caused by command execution. IBM X-Force ID: 125730.

CVSS: 8.8 · CWE: CWE-78

View on NVD

]]> [High] CVE-2016-5879 – MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute ... https://nvd.nist.gov/vuln/detail/CVE-2016-5879 https://nvd.nist.gov/vuln/detail/CVE-2016-5879 Fri, 02 Sep 2016 14:59:08 +0000 High CVE-2016-5879

MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availability command.

CVSS: 8.8 · CWE: CWE-20

View on NVD

]]> [High] CVE-2015-1987 – IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service... https://nvd.nist.gov/vuln/detail/CVE-2015-1987 https://nvd.nist.gov/vuln/detail/CVE-2015-1987 Mon, 03 Aug 2015 19:59:03 +0000 High CVE-2015-1987

IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1958.

CVSS: 7.8 · CWE: CWE-399

View on NVD

]]> [High] CVE-2015-1958 – IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service... https://nvd.nist.gov/vuln/detail/CVE-2015-1958 https://nvd.nist.gov/vuln/detail/CVE-2015-1958 Mon, 03 Aug 2015 19:59:02 +0000 High CVE-2015-1958

IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1987.

CVSS: 7.8 · CWE: CWE-399

View on NVD

]]> [High] CVE-2015-1956 – IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service... https://nvd.nist.gov/vuln/detail/CVE-2015-1956 https://nvd.nist.gov/vuln/detail/CVE-2015-1956 Mon, 03 Aug 2015 19:59:01 +0000 High CVE-2015-1956

IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987.

CVSS: 7.8 · CWE: CWE-399

View on NVD

]]> [High] CVE-2015-1955 – IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service... https://nvd.nist.gov/vuln/detail/CVE-2015-1955 https://nvd.nist.gov/vuln/detail/CVE-2015-1955 Mon, 03 Aug 2015 19:59:00 +0000 High CVE-2015-1955

IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data.

CVSS: 7.8 · CWE: CWE-399

View on NVD

]]>