CVE-2026-11729
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code in client applications due to unsafe deserialization that enables JNDI injection attacks.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.29%
- CWE
- CWE-502
- Published
- 2026-09-15
- Last modified
- 2026-09-16
Affected products
- IBM MQ
- IBM MQ
- IBM MQ
- IBM MQ
- IBM MQ
Weakness type
Related vulnerabilities
- CVE-2026-87719 — Deserialization of Untrusted Data in GitLab
- CVE-2026-72649 — Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-82222 — WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-70416 — Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthentica
- CVE-2026-17061 — Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026
- CVE-2026-4703 — WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
- CVE-2026-20307 — Cisco Identity Services Engine Remote Code Execution Vulnerability
- CVE-2026-12650 — A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated