CVE-2026-12538Medium· 5.4▾ SunlitIBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fie…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
mq_appliance >= 9.4.0.0 <= 9.4.0.26mq_appliance >= 9.4.1.0 <= 9.4.5.3mq_appliance >= 10.0.0.1 <= 10.0.0.5This vulnerability is addressed under APAR DT500605.
IBM strongly recommends addressing the vulnerability now.
IBM MQ Appliance version 9.4 LTS Apply IBM MQ Appliance fix pack 9.4.0.30 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.
IBM MQ Appliance version 9.4 CD - M2003 Upgrade to IBM MQ Appliance 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.
IBM MQ Appliance version 9.4 CD - M2002 Apply IBM MQ Appliance cumulative security update 9.4.5.4 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.
IBM MQ Appliance version 10 LTS Apply IBM MQ Appliance cumulative security update 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16179High· 7.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
CVE-2026-10747Critical· 10.0IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.
CVE-2026-17318High· 7.7Multiple Vulnerabilities in IBM API Connect
CVE-2026-17319High· 7.1Multiple Vulnerabilities in IBM API Connect
CVE-2026-17323High· 8.2Multiple Vulnerabilities in IBM API Connect
CVE-2026-17320High· 7.7Multiple Vulnerabilities in IBM API Connect