CVE-2026-12355

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS IBM MQ versions 9.2.0.0 through 9.2.0.43 LTS IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions 9.4.0.0 through 9.4.5.1 CD IBM MQ version 10.0.0.0

Description Insufficient input validation allows an attacker to perform JNDI injection attacks. JNDI injection occurs when an application fails to sanitize user-supplied input before using it in a Java Naming and Directory Interface (JNDI) lookup, which can lead to remote code execution or information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.