---
id: CVE-2026-10859
title: >-
  IBM MQ XMS .NET client is affected by an arbitrary code execution
  vulnerability
summary: >-
  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0
  through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through
  10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary
  code on cons…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: IBM
product: MQ
affected:
  - MQ >= 9.2.0.0 <= 9.2.0.44
  - MQ >= 9.3.0.0 <= 9.3.0.42
  - MQ >= 9.4.0.0 <= 9.4.0.26
  - MQ >= 9.4.0.0 <= 9.4.5.1
  - MQ >= 10.0.0.0 <= 10.0.0.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T04:56:26.094303Z'
published: '2026-11-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:37:18.375Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-10859'
references:
  - url: 'https://www.ibm.com/support/pages/node/7294664'
tags:
  - cve.org
epss: 0.00328
epssPercentile: 0.26113
ingestedAt: '2026-11-05T21:36:00.556Z'
---

## Overview

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.

## Affected

- `MQ >= 9.2.0.0 <= 9.2.0.44`
- `MQ >= 9.3.0.0 <= 9.3.0.42`
- `MQ >= 9.4.0.0 <= 9.4.0.26`
- `MQ >= 9.4.0.0 <= 9.4.5.1`
- `MQ >= 10.0.0.0 <= 10.0.0.5`

## Remediation

This issue was addressed under Known Issue DT472703.



IBM MQ version 9.2 LTS



 Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts 



IBM MQ version 9.3 LTS



 Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts 



IBM MQ version 9.4 LTS



 Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94 



IBM MQ version 10.0.LTS



 Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100 



IBM MQ version 9.4 CD and 10.0 CD



 Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100