CVE-2026-11729

IBM MQ contains an unsafe deserialization flaw (CWE-502) in versions spanning the 9.1 LTS through 10.0.0.0 release streams that enables JNDI injection attacks. A remote, authenticated attacker with low privileges can trigger the flaw by supplying malicious data that the client deserializes and resolves through JNDI, resulting in arbitrary code execution in client applications. Successful exploitation compromises confidentiality, integrity, and availability across a scope change, reflected in the high CVSS 3.1 score of 8.5. The attack requires valid credentials and high attack complexity, so it is most realistic inside multi-tenant environments or where attacker-controlled accounts exist. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the fix pack IBM identifies in its advisory for each affected LTS and CD stream, prioritizing any system where untrusted or multi-tenant users hold authenticated MQ client access. As interim hardening, restrict outbound LDAP/RMI connectivity from JVMs running MQ client applications to block malicious JNDI lookup resolution, and monitor for anomalous outbound directory-service connections. Audit which accounts can authenticate and connect with client privileges, since exploitation requires valid credentials.