---
id: CVE-2026-12538
title: IBM MQ Appliance is affected by an improper validation vulnerability
summary: >-
  IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could
  allow an authenticated attacker to obtain sensitive information or cause a
  denial of service due to improper validation of message header structure
  length fie…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-124
vendor: IBM
product: MQ Appliance
affected:
  - mq_appliance >= 9.4.0.0 <= 9.4.0.26
  - mq_appliance >= 9.4.1.0 <= 9.4.5.3
  - mq_appliance >= 10.0.0.1 <= 10.0.0.5
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T20:25:41.490Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12538'
references:
  - url: 'https://www.ibm.com/support/pages/node/7293035'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.556Z'
epss: 0.00333
epssPercentile: 0.26676
---

## Overview

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.

## Affected

- `mq_appliance >= 9.4.0.0 <= 9.4.0.26`
- `mq_appliance >= 9.4.1.0 <= 9.4.5.3`
- `mq_appliance >= 10.0.0.1 <= 10.0.0.5`

## Remediation

This vulnerability is addressed under APAR DT500605.



IBM strongly recommends addressing the vulnerability now.



IBM MQ Appliance version 9.4 LTS
Apply  IBM MQ Appliance fix pack 9.4.0.30 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.



IBM MQ Appliance version 9.4 CD - M2003
Upgrade to  IBM MQ Appliance 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.



IBM MQ Appliance version 9.4 CD - M2002
Apply  IBM MQ Appliance cumulative security update 9.4.5.4 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.



IBM MQ Appliance version 10 LTS
Apply  IBM MQ Appliance cumulative security update 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.