Login Request a demo
MQ
Product
MQ
by IBM · last CVE Oct 19, 2026
82
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities82In the news0Timeline
Severity mix
Critical 4High 38Medium 39Low 1
Severity
All severities82Critical4High38Medium39Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add MQ to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-10027
9.8
1%
Sep 18
IBM MQ queue manager is vulnerable to unauthenticated remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12351
9.8
1%
Sep 15
IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection
Affected: 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 LTS; 10.0.0.0
CVE-2020-4682
9.8
8%
Jan 28
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +30 more
CVE-2022-22489
9.1
2%
Aug 19
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
Affected: 8.0.0.0; 9.0.0.0; 9.1.0; 9.1.0.0; 9.2.0; 9.2.0
CVE-2026-11725
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to privilege escalation
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11378
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11375
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-10853
8.8
1%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-10575
8.8
0%
Sep 18
IBM MQ queue manager is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12728
8.8
1%
Sep 15
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13293
8.8
1%
Sep 14
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2025-0975
8.8
1%
Feb 28
IBM MQ code execution
Affected: 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-31912
8.8
0%
Jun 28
IBM MQ privilege escalation
Affected: 9.3.0; 9.3.0
CVE-2026-11729
8.5
1%
Sep 15
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-11728
8.1
0%
Sep 15
IBM MQ .NET client is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12355
8.1
1%
Sep 15
IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12666
8.1
0%
Sep 15
IBM MQ Java messaging is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2018-1998
7.8
0%
Mar 11
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges
Affected: 9.0.0.1; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +12 more
CVE-2026-10751
7.5
1%
Sep 18
IBM MQ Java messaging is vulnerable to remote code execution
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12354
7.5
0%
Sep 15
IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2025-36128
7.5
1%
Oct 16
IBM MQ denial of service
Affected: 9.1; 9.2; 9.3; 9.4; 9.3; 9.4
CVE-2025-3631
7.5
0%
Jul 11
IBM MQ denial of service
Affected: 9.3.2.0 CD through 9.3.5.1 CD; 9.4.0.0 through 9.4.2.1 CD; 9.4.0.0 LTS through 9.4.0.11 LTS
CVE-2024-35116
7.5
1%
Jun 28
IBM MQ denial of service
Affected: 9.0.0.0 before 9.0.0.26; 9.1.0.0 before 9.1.0.22; 9.2.0.0 before 9.2.0.26; 9.3.0.0 before 9.3.0.20; 9.3.0.0 before 9.4.0.0
CVE-2024-31919
7.5
0%
Jun 28
IBM MQ denial of service
Affected: 9.0.0.0; 9.1.0.0; 9.2.0; 9.3.0; 9.3.0
CVE-2024-25015
7.5
1%
May 1
IBM MQ denial of service
Affected: 9.2 LTS, 9.3 LTS, 9.3 CD
CVE-2024-25016
7.5
1%
Mar 3
IBM MQ denial of service
Affected: 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD
CVE-2023-28513
7.5
1%
Jul 19
IBM MQ denial of service
Affected: 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, 9.3 CD
CVE-2022-43902
7.5
1%
Mar 1
IBM MQ denial of service
Affected: 9.2 CD, 9.2 LTS, 9.3 CD, 9.3 LTS
CVE-2021-39034
7.5
1%
Feb 17
IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process
Affected: 9.1.0.0 through 9.1.0.9
CVE-2020-4870
7.5
2%
Dec 21
IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications
Affected: 9.2.0; 9.2.0
CVE-2020-4310
7.5
2%
Jun 16
IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic
Affected: 8.0.0.0 before 8.0.0.15; 9.0.0.0 before 9.0.0.10; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.5
CVE-2019-4762
7.5
2%
Apr 16
IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error in the Channel processing function
Affected: 9.0.0.0 before 9.0.0.9; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.3
CVE-2019-4055
7.5
2%
Apr 19
IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function
Affected: 8.0.0.0 through 8.0.0.10; 9.0.0.0 through 9.0.0.5; 9.1.0 through 9.1.1; 9.1.0.0 through 9.1.0.1
CVE-2018-1974
7.5
1%
Mar 11
IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels
Affected: 9.0.0.1; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +14 more
CVE-2018-1883
7.5
2%
Dec 7
A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into…
Affected: 9.0.2 through 9.0.5; 9.1.0.0
CVE-2019-4227
7.3
1%
Oct 4
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to…
Affected: 8.0.0.4 through 8.0.0.12; 9.0.0.0 through 9.0.0.6; 9.1.0 through 9.1.2; 9.1.0.0 through 9.1.0.2
CVE-2026-10030
7.1
0%
Sep 18
IBM MQ Console is vulnerable to privilege escalation
Affected: 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; 10.0.0.0
CVE-2026-12667
7.1
0%
Sep 15
IBM MQ .NET client is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13275
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13285
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13287
7.1
0%
Sep 14
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-12150
7.0
0%
Sep 15
IBM MQ queue manager is vulnerable to denial of service
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-13265
6.8
0%
Sep 14
IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-14511
6.5
0%
Oct 19
IBM MQ Denial of Service
Affected: 9.4.5.0 through 9.4.5.1
CVE-2025-23225
6.5
0%
Feb 28
IBM MQ denial of service
Affected: 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-51470
6.5
1%
Dec 18
IBM MQ denial of service
Affected: 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-35156
6.5
1%
Jun 28
IBM MQ information disclosure
Affected: 9.3.0.0 before 9.3.0.20; 9.3.0.0 before 9.4.0.0
CVE-2024-35155
6.5
1%
Jun 28
IBM MQ information disclosure
Affected: 9.3.0; 9.3.0
CVE-2022-43919
6.5
1%
May 5
IBM MQ denial of service
Affected: 9.2 CD, 9.2 LTS, 9.3 CD, 9.3 LTS
CVE-2022-31772
6.5
1%
Nov 11
IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels
Affected: 8.0.0.0; 9.0.0.0; 9.1.0; 9.1.0.0; 9.2.0; 9.2.0
Page 1 of 2 · 82 total
12