Canadian advisory covers IBM MQ and Watson Speech flaws
Original title: IBM security advisory (AV26-1135)
CVE-2026-11724 allows arbitrary code execution in MQ file transfer; CVE-2026-17493 can cause a denial of service.
The Canadian Centre for Cyber Security said that, as of November 4, IBM MQ and IBM Watson Speech Services Cartridge are affected by vulnerabilities. IBM MQ Managed File Transfer has an arbitrary code execution flaw tracked as CVE-2026-11724. The Watson cartridge is vulnerable to denial of service in Unpacker, CVE-2026-17493. Administrators are urged to review IBM’s bulletins and apply updates when available.
Unconfirmed: The alert does not say whether either flaw is exploited or name fixed versions.
- IBM MQ ranges include 10.0.0.5 LTS and CD and earlier listed LTS and CD releases.
- Watson Speech Services Cartridge 5.4.0 and earlier is listed as affected.
- The November 9 alert does not name fixed versions.
- The centre points readers to IBM Product Security bulletins.
Impact: Arbitrary code execution or denial of service
| Product | Affected |
|---|---|
| IBM MQ | Prior to or equal to 10.0.0.5 LTS and CD; 9.2.0.44 LTS; 9.3.0.42 LTS; 9.4.0.26 LTS; 9.4.5.1 CD |
| IBM Watson Speech Services Cartridge | Prior to or equal to 5.4.0 |
- 1.Review IBM’s linked security bulletins and apply updates when available.
- Vendors
- IBM
- Organizations
- Canadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-11724 | Authenticated RCE in IBM MQ Managed File Transfer agent | 8.5 | — | ||
| CVE-2026-17493 | Out-of-bounds read in IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 | 7.5 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1135 Date: November 9, 2026 As of November 4, 2026, IBM is affected by vulnerabilities in the following products: IBM MQ Prior to or equal to 10. 0. 0.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.