CVE-2026-12354

IBM MQ ships a Resource Adapter Installation Verification Test (IVT) application that improperly validates JNDI names (CWE-913), allowing an authenticated attacker with network access to supply a malicious JNDI lookup and achieve arbitrary code execution on the application server hosting the resource adapter, in a Log4Shell-style pattern. Exploitation requires valid credentials (PR:L) and somewhat difficult conditions (AC:H), but success yields high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.5). Every currently shipped release stream is affected, from 9.1 LTS through 9.2, 9.3, and 9.4 LTS/CD up to 10.0.0.0. No public proof of concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is presumed unlikely at this time.

What to do: Upgrade to the newest fix pack IBM has published for your release stream — anything beyond the affected ranges listed above — and prioritize migration off the aging 9.1/9.2 LTS streams, which are at or near end of support. If the Resource Adapter Installation Verification Test application is not required in production, undeploy or disable it, restrict authenticated access to it, and limit the application server's ability to make outbound JNDI/LDAP/RMI connections. Review application server logs for unexpected JNDI lookups or outbound directory traffic as an indicator of attempted exploitation.