CVE-2026-10751: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-10751 is a deserialization filter bypass vulnerability in IBM MQ Java and JMS client libraries that allows an authenticated remote attacker to execute arbitrary code on client applications. The flaw exists in exception handling logic within the affected libraries. Affected versions span IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0. It was published on September 18, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, IBM Support).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The root cause is a bypass of the deserialization filter within exception handling code paths in the IBM MQ Java and JMS client libraries — meaning that deserialization protections that would normally block untrusted object graphs are not applied when exceptions are raised during message processing. An authenticated attacker with network access to an IBM MQ broker can craft malicious serialized payloads that are processed through the unprotected exception handling path, leading to arbitrary code execution on the client application. The attack requires low privileges and no user interaction, but has high complexity, suggesting specific conditions or timing must be met (GitHub Advisory, IBM Support).

Successful exploitation results in arbitrary code execution on client applications using the IBM MQ Java or JMS libraries, with full impact to confidentiality, integrity, and availability. An attacker who achieves code execution on a client application could exfiltrate sensitive data processed through the MQ messaging infrastructure, tamper with messages, or disrupt client application availability. Given that IBM MQ is commonly used in enterprise middleware and financial services environments, compromise of client applications could facilitate lateral movement into broader internal networks (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication and high attack complexity, which raises the bar for opportunistic attackers, though targeted exploitation by sophisticated actors remains a concern given the enterprise prevalence of IBM MQ.

IBM has released patches addressing this vulnerability; users should update IBM MQ Java and JMS client libraries to versions beyond the affected ranges (i.e., above 9.1.0.37 LTS, 9.2.0.43 LTS, 9.3.0.41 LTS, 9.3.5.1 CD, 9.4.0.25 LTS, 9.4.5.1 CD, and 10.0.0.0 as applicable). Refer to the IBM support page for specific fix pack details. As interim mitigations, restrict network access to IBM MQ brokers to authenticated and authorized users only, and monitor exception handling logs for anomalous deserialization activity (IBM Support, GitHub Advisory).