Canadian advisory covers IBM MQ and Watson Speech flaws
CVE-2026-11724 allows arbitrary code execution in MQ file transfer; CVE-2026-17493 can cause a denial of service.
62
CVE-2026-11724
Authenticated RCE in IBM MQ Managed File Transfer agent
- CVSS 3.1
- 8.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper validation of metadata used during script execution allows an authenticated attacker to execute arbitrary code on an IBM MQ Managed File Transfer agent host. The flaw can be triggered with network access and low privileges, without user interaction. This affects users of vulnerable IBM MQ versions.
What to do: Apply IBM's update for CVE-2026-11724
| Product | Affected |
|---|---|
| IBM MQ | 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
- Weakness
- CWE-20
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H