CVE-2026-11729

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS IBM MQ versions 9.2.0.0 through 9.2.0.43 LTS IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions 9.4.0.0 through 9.4.5.1 CD IBM MQ version 10.0.0.0

Description An authenticated attacker can execute arbitrary code in client applications. This is possible due to unsafe deserialization, which enables JNDI injection attacks. JNDI injection occurs when an application fails to sanitize input used in a Java Naming and Directory Interface lookup, allowing the attacker to redirect the lookup to a malicious server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.