Insecure Deserialization Vulnerability in IBM MQ Products
CVE-2026-10859

7.5HIGH

Key Information:

Vendor

IBM
Status
MQ
Vendor
CVE Published:
4 November 2026

What is CVE-2026-10859?

An insecure deserialization vulnerability in IBM MQ allows authenticated attackers to execute arbitrary code on consumer applications. The flaw affects several versions of IBM MQ products, as it results from insecure handling of ObjectMessage payloads. When exploited, this vulnerability gives attackers the capability to manipulate serialized data, potentially leading to unauthorized access and control over the affected systems. Users are strongly urged to apply the recommended patches provided by IBM to mitigate the risks associated with this security issue.

Affected Version(s)

MQ 9.2.0.0 <= 9.2.0.44

MQ 9.3.0.0 <= 9.3.0.42

MQ 9.4.0.0 <= 9.4.0.26

References

https://www.ibm.com/support/pages/node/7294664
vendor-advisorypatch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.