Denial of Service Vulnerability in IBM MQ
CVE-2026-12155

6.5MEDIUM

Key Information:

Vendor

IBM
Status
MQ Operator
MQ Advanced Container Images
Vendor
CVE Published:
19 October 2026

What is CVE-2026-12155?

A vulnerability has been identified in IBM MQ that allows an authenticated attacker to exploit a denial of service scenario. By sending specially crafted multicast status messages, the attacker can trigger a NULL pointer dereference, leading to potential disruption of service. It is crucial for users of IBM MQ versions 9.1 and 9.2 to apply the latest patches to mitigate this risk and ensure the continued stability of their messaging systems.

Affected Version(s)

MQ Advanced container images 9.4.0.6-r1

MQ Advanced container images 9.4.0.6-r2

MQ Advanced container images 9.4.0.7-r1

References

https://www.ibm.com/support/pages/node/7292667
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.