CVE-2026-12356 PUBLISHED

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Assigner: ibm
Reserved: 15.06.2026 Published: 04.11.2026 Updated: 04.11.2026

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.5

Product Status

Vendor IBM
Product MQ
Versions
  • affected from 9.2.0.0 to 9.2.0.44 (incl.)
  • affected from 9.3.0.0 to 9.3.0.42 (incl.)
  • affected from 9.4.0.0 to 9.4.0.26 (incl.)
  • affected from 9.4.0.0 to 9.4.5.1 (incl.)
  • affected from 10.0.0.0 to 10.0.0.5 (incl.)

Solutions

This issue was addressed under Known Issue DT473747.

IBM MQ version 9.2 LTS

Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts

IBM MQ version 9.3 LTS

Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts

IBM MQ version 9.4 LTS

Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94

IBM MQ version 10.0.LTS

Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100

IBM MQ version 9.4 CD and 10.0 CD

Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

References

Problem Types

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE