---
id: "CVE-2026-10859"
kind: "vulnerability"
aliases: ["CVE-2026-10859"]
title: "IBM MQ: ObjectMessage deserialization lets an authenticated user run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "IBM MQ (.NET messaging / XMS .NET client)", "fixed": ["9.2.0.46", "9.3.0.43", "9.4.0.30", "10.0.0.6", "10.0.1.0"], "affected": "9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD", "ecosystem": "vendor"}]
ecosystems: []
tags: ["deserialization", "dotnet", "ibm-mq", "java", "messaging", "runtime", "xms"]
not_affected_if: ["auth-required", "no-dotnet-messaging-component", "no-objectmessage-consumers"]
published_at: "2026-11-04T21:17:48+00:00"
first_seen_at: "2026-11-04T21:49:17+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10859", "first_seen_at": "2026-11-04T21:49:17+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859", "first_seen_at": "2026-11-04T21:54:26+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859"]}]
exploit_sources: []
---

# IBM MQ: ObjectMessage deserialization lets an authenticated user run code

IBM's bulletin says the IBM MQ XMS .NET client (the .NET messaging component of IBM MQ) insecurely deserializes ObjectMessage payloads, so an authenticated attacker could execute arbitrary code in consumer applications. IBM lists no workarounds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM MQ (.NET messaging / XMS .NET client) affected 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD fixed 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6, 10.0.1.0

## How to check

- Only the .NET messaging (XMS .NET) component is named by IBM. Run dspmqver on the host to see the MQ level and whether the .NET messaging component is installed; affected levels: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD.
- Look for .NET applications that use the XMS .NET client (IBM.XMS assembly) and receive ObjectMessage messages.
- Also check if you use the Java/JMS MQ classes: the bulletin does not name them.

## Fix

Apply IBM's fixes: 9.2 LTS cumulative security update 9.2.0.46; 9.3 LTS 9.3.0.43; 9.4 LTS fix pack 9.4.0.30; 10.0 LTS upgrade to 10.0.0.6; 9.4 CD and 10.0 CD upgrade to 10.0.1.0 (Known Issue DT472703).

## Timeline

- 2026-11-04T21:49:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-10859
- 2026-11-04T21:54:26+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859 — Read IBM bulletin: the flaw is in the XMS .NET client component, not the whole MQ server as NVD wording implied; title corrected. Fixes per IBM. No workarounds listed. No exploitation or PoC found; X not checked.

## Documents

- [advisory] IBM Security Bulletin: IBM MQ XMS .NET client arbitrary code execution (CVE-2026-10859) https://www.ibm.com/support/pages/security-bulletin-ibm-mq-xms-net-client-affected-arbitrary-code-execution-vulnerability-cve-2026-10859

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_