CVE-2026-12538 (GCVE-0-2026-12538)

Vulnerability from cvelistv5 – Published: 2026-11-04 20:25 – Updated: 2026-11-04 20:25
VLAI
Title
IBM MQ Appliance is affected by an improper validation vulnerability
Summary
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CWE
  • CWE-124 - Buffer Underwrite ('Buffer Underflow')
Assigner
ibm CNA under the mitre root
CNA scorecard B 88/100 over 1335 records in the last 180 days details
References
URL Tags
https://www.ibm.com/support/pages/node/7293035 vendor-advisorypatch
Impacted products
Vendor Product Version CPE status
IBM MQ Appliance Affected: 9.4.0.0 , ≤ 9.4.0.26 (semver)
Affected: 9.4.1.0 , ≤ 9.4.5.3 (semver)
Affected: 10.0.0.1 , ≤ 10.0.0.5 (semver)
    cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*"
          ],
          "product": "MQ Appliance",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "9.4.0.26",
              "status": "affected",
              "version": "9.4.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.4.5.3",
              "status": "affected",
              "version": "9.4.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.0.0.5",
              "status": "affected",
              "version": "10.0.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.\u003c/p\u003e"
            }
          ],
          "value": "IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-124",
              "description": "CWE-124 Buffer Underwrite (\u0027Buffer Underflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:25:41.490Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7293035"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis vulnerability is addressed under APAR DT500605.\u003c/p\u003e\u003cp\u003eIBM strongly recommends addressing the vulnerability now.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eIBM MQ Appliance version 9.4 LTS\u003c/strong\u003e\u003cbr/\u003eApply \u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere\u0026amp;product=ibm/WebSphere/IBM+MQ+Appliance+M2000\u0026amp;function=fixId\u0026amp;fixids=9.4.0.30-IBM-MQ-Appliance+\u0026amp;includeSupersedes=1\" rel=\"nofollow\"\u003eIBM MQ Appliance fix pack 9.4.0.30\u003c/a\u003e, or later firmware.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eIBM MQ Appliance version 9.4 CD - M2003\u003c/strong\u003e\u003cbr/\u003eUpgrade to \u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere\u0026amp;product=ibm/WebSphere/IBM+MQ+Appliance+M2000\u0026amp;function=fixId\u0026amp;fixids=10.0.0.6-IBM-MQ-Appliance+\u0026amp;includeSupersedes=1\" rel=\"nofollow\"\u003eIBM MQ Appliance 10.0.0.6\u003c/a\u003e, or later firmware.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eIBM MQ Appliance version 9.4 CD - M2002\u003c/strong\u003e\u003cbr/\u003eApply \u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere\u0026amp;product=ibm/WebSphere/IBM+MQ+Appliance+M2000\u0026amp;function=fixId\u0026amp;fixids=9.4.5.4-IBM-MQ-Appliance+\u0026amp;includeSupersedes=1\" rel=\"nofollow\"\u003eIBM MQ Appliance cumulative security update 9.4.5.4\u003c/a\u003e, or later firmware.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eIBM MQ Appliance version 10 LTS\u003c/strong\u003e\u003cbr/\u003eApply \u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere\u0026amp;product=ibm/WebSphere/IBM+MQ+Appliance+M2000\u0026amp;function=fixId\u0026amp;fixids=10.0.0.6-IBM-MQ-Appliance+\u0026amp;includeSupersedes=1\" rel=\"nofollow\"\u003eIBM MQ Appliance cumulative security update 10.0.0.6\u003c/a\u003e, or later firmware.\u003c/p\u003e"
            }
          ],
          "value": "This vulnerability is addressed under APAR DT500605.\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\nIBM MQ Appliance version 9.4 LTS\nApply  IBM MQ Appliance fix pack 9.4.0.30 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2003\nUpgrade to  IBM MQ Appliance 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2002\nApply  IBM MQ Appliance cumulative security update 9.4.5.4 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 10 LTS\nApply  IBM MQ Appliance cumulative security update 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware."
        }
      ],
      "title": "IBM MQ Appliance is affected by an improper validation vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-12538",
    "datePublished": "2026-11-04T20:25:41.490Z",
    "dateReserved": "2026-06-17T15:22:07.491Z",
    "dateUpdated": "2026-11-04T20:25:41.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-12538",
      "date": "2026-11-06",
      "epss": "0.00333",
      "percentile": "0.26641"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*"
                ],
                "product": "MQ Appliance",
                "vendor": "IBM",
                "versions": [
                  {
                    "lessThanOrEqual": "9.4.0.26",
                    "status": "affected",
                    "version": "9.4.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.4.5.3",
                    "status": "affected",
                    "version": "9.4.1.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "10.0.0.5",
                    "status": "affected",
                    "version": "10.0.0.1",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@us.ibm.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields."
          }
        ],
        "id": "CVE-2026-12538",
        "lastModified": "2026-11-04T21:18:11.563",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.5,
              "source": "psirt@us.ibm.com",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-11-04T21:18:11.440",
        "references": [
          {
            "source": "psirt@us.ibm.com",
            "url": "https://www.ibm.com/support/pages/node/7293035"
          }
        ],
        "sourceIdentifier": "psirt@us.ibm.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-124"
              }
            ],
            "source": "psirt@us.ibm.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.