{"id":"CVE-2026-10859","kind":"vulnerability","aliases":["CVE-2026-10859"],"related":[],"title":"IBM MQ: ObjectMessage deserialization lets an authenticated user run code","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.","summary":"IBM's bulletin says the IBM MQ XMS .NET client (the .NET messaging component of IBM MQ) insecurely deserializes ObjectMessage payloads, so an authenticated attacker could execute arbitrary code in consumer applications. IBM lists no workarounds.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM MQ (.NET messaging / XMS .NET client)","fixed":["9.2.0.46","9.3.0.43","9.4.0.30","10.0.0.6","10.0.1.0"],"affected":"9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD","ecosystem":"vendor"}],"ecosystems":[],"tags":["deserialization","dotnet","ibm-mq","java","messaging","runtime","xms"],"not_affected_if":["auth-required","no-dotnet-messaging-component","no-objectmessage-consumers"],"how_to_check":"- Only the .NET messaging (XMS .NET) component is named by IBM. Run dspmqver on the host to see the MQ level and whether the .NET messaging component is installed; affected levels: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD.\n- Look for .NET applications that use the XMS .NET client (IBM.XMS assembly) and receive ObjectMessage messages.\n- Also check if you use the Java/JMS MQ classes: the bulletin does not name them.","fix":"Apply IBM's fixes: 9.2 LTS cumulative security update 9.2.0.46; 9.3 LTS 9.3.0.43; 9.4 LTS fix pack 9.4.0.30; 10.0 LTS upgrade to 10.0.0.6; 9.4 CD and 10.0 CD upgrade to 10.0.1.0 (Known Issue DT472703).","status":"open","published_at":"2026-11-04T21:17:48+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","triaged_at":"2026-11-04T21:50:53+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-04T21:50:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ: ObjectMessage deserialization lets an authenticated user run code","impact":"high","summary":"IBM MQ, a messaging server used by businesses, unsafely deserializes ObjectMessage payloads. An authenticated attacker can make consumer applications execute arbitrary code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ibm-mq","java","messaging"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker runs arbitrary code inside consumer applications","analyst_note":"Check the IBM security bulletin for the CVE-2026-10859 fixed levels and confirm whether the flaw needs a specific consumer configuration.","how_to_check":"- Check the installed IBM MQ level with `dspmqver` and compare it with the affected ranges: 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD.\n- Identify consumer applications that read ObjectMessage messages from queues.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","no-objectmessage-consumers"],"who_is_affected":"Systems running the affected IBM MQ releases, especially consumer applications that receive ObjectMessage payloads from queues. The attacker must hold valid credentials to the messaging system. Teams on releases outside the listed ranges, or that do not consume ObjectMessage payloads, are likely not exposed; the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4243,"output_tokens":666,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for the CVE-2026-10859 fixed levels and confirm whether the flaw needs a specific consumer configuration.","search":"'-10859':13A,16A '-2026':12A,15A '10.0.0.0':88C '10.0.0.5':90C '9.2.0.0':71C '9.2.0.44':73C '9.3.0.0':75C '9.3.0.42':77C '9.4.0.0':79C,83C '9.4.0.26':81C '9.4.5.1':85C 'allow':95C 'applic':64B,105C 'arbitrari':60B,101C 'attack':57B,98C 'authent':7A,56B,97C 'bulletin':35B 'cd':86C,93C 'client':23A,42B 'code':10A,61B,102C 'compon':46B 'consum':63B,104C 'could':58B,94C 'cve':11A,14A 'deseri':4A,24B,51B,109C 'dotnet':25B 'due':106C 'execut':59B,100C 'ibm':1A,17A,27B,33B,38B,48B,65B,69C 'ibm-mq':26B 'insecur':50B,108C 'java':29B 'let':5A 'list':66B 'lts':74C,78C,82C,91C 'messag':30B,45B 'messaging':20A 'mq':2A,18A,28B,39B,49B,70C 'net':19A,22A,41B,44B 'objectmessag':3A,52B,111C 'payload':53B,112C 'run':9A 'runtim':31B 'say':36B 'user':8A 'workaround':68B 'xms':21A,32B,40B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ with the .NET messaging (XMS .NET client) component, whose .NET consumer applications read ObjectMessage payloads. The attacker needs valid credentials to the messaging system, and IBM rates attack complexity high. Sites without the .NET messaging component or without ObjectMessage consumers can likely skip it; IBM does not state this explicitly.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:54:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859","run_id":1722},"products":{"at":"2026-11-04T21:54:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859","run_id":1722},"who_affected":{"at":"2026-11-04T21:54:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859","run_id":1722}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmmqnetmessagingxmsnetclient","mqnetmessagingxmsnetclient"],"ptokens":["client","ibm","messaging","mq","net","xms"],"labels":["deserialization","dotnet","high","ibmmq","java","messaging","runtime","xms"],"campaign_type":null,"first_public_at":"2026-11-04T21:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10859","severity":null,"published_at":"2026-11-04T21:17:48+00:00","modified_at":"2026-11-04T21:17:48+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","fetched_at":"2026-11-04T21:49:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10859:1722","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859","severity":null,"published_at":"2026-11-04T21:54:26+00:00","modified_at":"2026-11-04T21:54:26+00:00","first_seen_at":"2026-11-04T21:54:26+00:00","fetched_at":"2026-11-04T21:54:26+00:00","note":"Read IBM bulletin: the flaw is in the XMS .NET client component, not the whole MQ server as NVD wording implied; title corrected. Fixes per IBM. No workarounds listed. No exploitation or PoC found; X not checked.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859"]}],"documents":[{"id":70884,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859","title":"IBM Security Bulletin: IBM MQ XMS .NET client arbitrary code execution (CVE-2026-10859)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}