7.5

CVE-2026-12354

IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerIBM
≫
Produkt MQ
Version <= 9.1.0.37 LTS
Version 9.1.0.0
Status affected
Version <= 9.2.0.43 LTS
Version 9.2.0.0
Status affected
Version <= 9.3.0.41 LTS
Version 9.3.0.0
Status affected
Version <= 9.3.5.1 CD
Version 9.3.0.0
Status affected
Version <= 9.4.0.25 LTS
Version 9.4.0.0
Status affected
Version <= 9.4.5.1 CD
Version 9.4.0.0
Status affected
Version 10.0.0.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.383
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
IBM 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-913 Improper Control of Dynamically-Managed Code Resources

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

https://www.ibm.com/support/pages/node/7284908