CVE-2026-13293

IBM MQ contains a flaw in which untrusted data is deserialized (CWE-502), allowing a remote authenticated attacker to execute arbitrary code on the system running the queue manager. The flaw is triggered over the network by an attacker holding valid MQ credentials or a compromised application account who submits crafted serialized data that the broker processes, achieving code execution with the privileges of the MQ process. The issue is rated high severity (CVSS 3.1: 8.8) with high impact on confidentiality, integrity, and availability, meaning a successful attacker effectively controls the messaging server and the message traffic it handles. The affected footprint is broad across the supported product line: IBM MQ 9.1 LTS through 9.4 LTS/CD streams and 10.0.0.0. There is no known public proof of concept, the CVE is not on the CISA KEV list, and no exploitation in the wild has been reported, though the authentication requirement makes credential hygiene a critical compensating control.

What to do: Apply IBM's fix packs and move to builds later than the affected terminal levels (9.1.0.37, 9.2.0.43, 9.3.0.41 / 9.3.5.1, 9.4.0.25 / 9.4.5.1) or off 10.0.0.0 per IBM's security bulletin. Tighten channel authentication with CHLAUTH rules, TLS, and least-privilege MQ user accounts so a single stolen credential cannot reach privileged channels. Review MQ error and authentication logs for unexpected client connections or activity from low-privilege accounts.