CVE-2026-10027: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-10027 is a buffer overflow vulnerability in IBM MQ that allows a remote, unauthenticated attacker to cause a denial of service or execute arbitrary code by sending malformed compressed data to channels configured with compression enabled. It affects IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS and 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS and 9.4.5.1 CD, and 10.0.0.0. The vulnerability was published on September 18, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, IBM Support).

The root cause is an out-of-bounds write (CWE-787) in IBM MQ's channel compression handling logic, which fails to properly validate the size or structure of compressed data before writing it to a buffer. An attacker can exploit this by sending specially crafted, malformed compressed data over the network to an IBM MQ channel that has compression enabled, triggering the overflow without requiring authentication or user interaction. The high attack complexity rating reflects that the attacker must have knowledge of the target's channel configuration (specifically that compression is enabled) and craft a precise malformed payload to trigger the overflow reliably (GitHub Advisory, IBM Support).

Successful exploitation can result in either a denial of service (crash of the IBM MQ service) or arbitrary code execution on the affected host, with high impacts to confidentiality, integrity, and availability. An unauthenticated remote attacker who achieves code execution could gain control of the MQ broker, potentially accessing sensitive messages in transit, manipulating message queues, or using the compromised host as a pivot point for lateral movement within the enterprise network. IBM MQ is commonly deployed in critical enterprise middleware environments, making disruption or compromise of this service particularly impactful (GitHub Advisory, IBM Support).

As of the publication date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement (precise crafting of malformed compressed data targeting compression-enabled channels) raises the bar for exploitation compared to simpler remote vulnerabilities.

IBM has released patches addressing this vulnerability; administrators should apply the relevant fix pack for their version (beyond 9.1.0.37 LTS, 9.2.0.43 LTS, 9.3.0.41 LTS, 9.3.5.1 CD, 9.4.0.25 LTS, 9.4.5.1 CD, or 10.0.0.0 as applicable) as detailed in the IBM support page (IBM Support). If immediate patching is not feasible, organizations should disable compression on IBM MQ channels as a workaround, or restrict network access to MQ endpoints to trusted systems only. Prioritize patching for internet-facing or externally accessible MQ deployments.