← CVE Radar
CVE-2026-10859IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.
7.5 HIGHEPSS 0.32%Not in KEVNVD: Undergoing Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 3.1ibm (CNA) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-10859
- Status
- Undergoing Analysis
- Assigner (CNA)
- ibm
- Published
- Nov 4, 2026
- Last modified
- 2026-11-06 12:17 UTC
Affected Products
As published by the CNA in the CVE record.
IBMMQ5 version ranges
- 9.2.0.0 through 9.2.0.44
- 9.3.0.0 through 9.3.0.42
- 9.4.0.0 through 9.4.0.26
- 9.4.0.0 through 9.4.5.1
- 10.0.0.0 through 10.0.0.5