CVE-2026-12355

IBM MQ contains a JNDI (Java Naming and Directory Interface) injection flaw caused by insufficient input validation of attacker-controlled data, identified as CVE-2026-12355 with a high CVSS 3.1 base score of 8.1. An unauthenticated remote attacker who can reach an affected queue manager may supply crafted input that triggers a JNDI lookup against an attacker-controlled naming/directory service (such as LDAP or RMI), which can result in information disclosure or remote code execution on the MQ server. The issue spans an unusually broad set of supported releases, from 9.1 LTS through the 9.3/9.4 continuous delivery streams and initial 10.0.0.0 code, so most currently deployed MQ estates are likely in scope. Exploitation requires high attack complexity per the CVSS vector, which somewhat lowers practical exploitability. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

What to do: Apply IBM's fixed fix packs for your release stream as soon as they are available (the affected ranges indicate fixes land in the next fix pack of each 9.1/9.2/9.3/9.4 stream and a subsequent 10.0 build; confirm exact fixed levels in IBM's advisory). Until patched, restrict network access to MQ listeners and admin channels so only trusted clients can connect, and enforce egress filtering on MQ servers to block outbound LDAP/RMI connections to untrusted destinations, which blunts JNDI lookup callbacks. Also review queue manager and connection logs for unexpected JNDI lookups or outbound directory traffic, and prioritize any queue manager reachable from the internet.