IBM MQ · CVE-2026-12356 · Infrastructure
FIX → 9.2.0.46 · 9.3.0.43 · 9.4.0.30 · 10.0.0.6 ✓ verified
IBM's bulletin (29 Oct 2026) says the Managed File Transfer (MFT) component of IBM MQ lets an authenticated user with command queue access execute arbitrary code by injecting arguments into Ant script commands. CVSS 7.5 (AV:N/AC:H/PR:L). The bulletin does not mention exploitation or a public PoC; Tenable/NotCVE show not in CISA KEV.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IBM MQ with the Managed File Transfer component installed on the listed versions. Exploitation needs an authenticated user with command queue access and high attack complexity. Installations without MFT, or where only trusted admins can reach the MFT command queues, are at low risk.
Not affected if auth-required, no-command-queue-access, no-mft-component, no-mfт-component
Who cares ibm-mq, managed-file-transfer, messaging, middleware, self-hosted
9.2.0.0-9.2.0.44, 9.3 LTS 9.3.0.0-9.3.0.42, 9.4 LTS 9.4.0.0-9.4.0.26, 9.4 CD , (LTS and CD)IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.4.0.0-9.4.5.110.0.0.0-10.0.0.5Upgrade to 9.2.0.46 · 9.3.0.43 · 9.4.0.30 · 10.0.0.6
Per IBM (known issue DT473747): 9.2 LTS apply 9.2.0.46; 9.3 LTS apply 9.3.0.43; 9.4 LTS apply fix pack 9.4.0.30; 10.0 LTS upgrade to 10.0.0.6; 9.4 CD and 10.0 CD upgrade to 10.0.1.0.