---
id: "CVE-2026-12356"
kind: "vulnerability"
aliases: ["CVE-2026-12356"]
title: "IBM MQ: authenticated users with command queue access can run arbitrary code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM MQ", "fixed": ["9.2.0.46", "9.3.0.43", "9.4.0.30", "10.0.0.6", "10.0.1.0"], "affected": "9.2.0.0-9.2.0.44 LTS; 9.3.0.0-9.3.0.42 LTS; 9.4.0.0-9.4.0.26 LTS; 9.4.0.0-9.4.5.1 CD; 10.0.0.0-10.0.0.5 (Managed File Transfer component)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-mq", "infrastructure", "managed-file-transfer", "messaging", "middleware", "self-hosted"]
not_affected_if: ["auth-required", "no-command-queue-access", "no-mft-component", "no-mf\u0442-component"]
published_at: "2026-11-04T21:18:11+00:00"
first_seen_at: "2026-11-04T21:49:21+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12356", "first_seen_at": "2026-11-04T21:49:21+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-12356", "first_seen_at": "2026-11-04T21:53:34+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-12356"]}]
exploit_sources: []
---

# IBM MQ: authenticated users with command queue access can run arbitrary code

IBM's bulletin (29 Oct 2026) says the Managed File Transfer (MFT) component of IBM MQ lets an authenticated user with command queue access execute arbitrary code by injecting arguments into Ant script commands. CVSS 7.5 (AV:N/AC:H/PR:L). The bulletin does not mention exploitation or a public PoC; Tenable/NotCVE show not in CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM MQ affected 9.2.0.0-9.2.0.44 LTS; 9.3.0.0-9.3.0.42 LTS; 9.4.0.0-9.4.0.26 LTS; 9.4.0.0-9.4.5.1 CD; 10.0.0.0-10.0.0.5 (Managed File Transfer component) fixed 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6, 10.0.1.0

## How to check

Only installations with the Managed File Transfer component installed are affected (IBM lists MFT as the affected component). Check the version with dspmqver and whether MFT is installed. Affected: 9.2 LTS 9.2.0.0-9.2.0.44, 9.3 LTS 9.3.0.0-9.3.0.42, 9.4 LTS 9.4.0.0-9.4.0.26, 9.4 CD 9.4.0.0-9.4.5.1, 10.0.0.0-10.0.0.5 (LTS and CD). Also review who holds access to the MFT command queue (SYSTEM.FTE.COMMAND.*).

## Fix

Per IBM (known issue DT473747): 9.2 LTS apply 9.2.0.46; 9.3 LTS apply 9.3.0.43; 9.4 LTS apply fix pack 9.4.0.30; 10.0 LTS upgrade to 10.0.0.6; 9.4 CD and 10.0 CD upgrade to 10.0.1.0.

## Timeline

- 2026-11-04T21:49:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12356
- 2026-11-04T21:53:34+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-12356 — Fixed a typo in a not-affected-if tag.

## Documents

- [advisory] IBM Security Bulletin: MQ Managed File Transfer arbitrary code execution (CVE-2026-12356) https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-12356

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_