CVE-2026-12728

IBM MQ contains a deserialization-of-untrusted-data flaw that allows an authenticated, remote attacker to execute arbitrary code on the affected queue manager. Exploitation requires valid credentials to the MQ service, after which the attacker sends crafted serialized data that is deserialized insecurely, yielding code execution with the privileges of the MQ process. Successful exploitation compromises confidentiality, integrity, and availability of the messaging backbone, which typically carries sensitive transactional data in banking, retail, and government environments. All currently supported IBM MQ streams are affected, spanning the 9.1 through 9.4 LTS and CD streams as well as 10.0.0.0. No public proof-of-concept exists and the flaw is not on the CISA KEV catalog, so exploitation in the wild is not currently known.

What to do: Apply the fix packs IBM released for this advisory on every affected LTS and CD stream (i.e., versions later than the affected ranges listed above, per IBM's security bulletin) and prioritize 10.0.0.0 instances. Restrict administrative and application credentials, since exploitation requires authentication: enforce least-privilege MQ authorities, segment queue manager listeners and web consoles from untrusted networks, and disable or firewall-exposure-limit the MQ console where feasible. Review authentication and channel activity logs for anomalous behavior by low-privilege accounts preceding any unexpected process execution on MQ hosts.