CVE-2026-12354 — IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection

Description (CNA)

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application.

Affected (CNA)

Vendor / product	Versions
IBM / MQ	affected 9.1.0.0 through 9.1.0.37 LTS; affected 9.2.0.0 through 9.2.0.43 LTS; affected 9.3.0.0 through 9.3.0.41 LTS; affected 9.3.0.0 through 9.3.5.1 CD; affected 9.4.0.0 through 9.4.0.25 LTS; affected 9.4.0.0 through 9.4.5.1 CD; affected 10.0.0.0

CWE

CWE-913

References

https://www.ibm.com/support/pages/node/7284908

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.