← CVE Radar
CVE-2026-12356IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.
7.5 HIGHEPSS 0.34%Not in KEVNVD: Undergoing Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 3.1ibm (CNA) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-12356
- Status
- Undergoing Analysis
- Assigner (CNA)
- ibm
- Published
- Nov 4, 2026
- Last modified
- 2026-11-06 12:17 UTC
- Weaknesses
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected Products
As published by the CNA in the CVE record.
IBMMQ5 version ranges
- 9.2.0.0 through 9.2.0.44
- 9.3.0.0 through 9.3.0.42
- 9.4.0.0 through 9.4.0.26
- 9.4.0.0 through 9.4.5.1
- 10.0.0.0 through 10.0.0.5