CVE-2026-12351

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions 9.4.0.0 through 9.4.5.1 LTS IBM MQ version 10.0.0.0

Description A remote attacker can execute arbitrary code when the IVT application is deployed. This is caused by unsafe JNDI (Java Naming and Directory Interface) lookup processing, which is a Java API that allows applications to discover and look up data and objects via different naming and directory services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.