CVE-2026-10853: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-10853 is a vulnerability in IBM MQ that allows an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths. It affects IBM MQ across multiple release streams: LTS versions 9.1.0.0–9.1.0.37, 9.2.0.0–9.2.0.43, 9.3.0.0–9.3.0.41, and 9.4.0.0–9.4.0.25; Continuous Delivery versions 9.3.0.0–9.3.5.1, 9.4.0.0–9.4.5.1, and 10.0.0.0. The vulnerability was published on September 18, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 8.8 (High) per NVD/Feedly, or 7.5 (High) per the GitHub Advisory and ENISA EUVD (GitHub Advisory, IBM Advisory).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — 'Unsafe Reflection'), combined with improper validation of cluster command message lengths. An authenticated attacker with access to the IBM MQ cluster can craft malicious cluster command messages with manipulated length fields, which the queue manager processes without adequate bounds checking, potentially triggering unsafe reflection or memory corruption. Exploitation requires network access to MQ cluster communication ports and low-level privileges (cluster membership), but no user interaction. No public proof-of-concept code has been identified (GitHub Advisory, IBM Advisory).

Successful exploitation can result in a complete compromise of the affected IBM MQ queue manager, with high impact to confidentiality, integrity, and availability. An attacker could crash the MQ service (denial of service), disrupting message-based workloads and dependent applications, or potentially execute arbitrary code on the queue manager host. Given IBM MQ's role as enterprise middleware, a compromised queue manager could expose sensitive business messages in transit and serve as a pivot point for lateral movement within the enterprise environment (GitHub Advisory, IBM Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.355–0.374%, placing it in roughly the 29th percentile for exploitation likelihood within 30 days. The NVD SSVC assessment notes exploitation is currently 'none' and the attack is not automatable, as it requires authenticated cluster access. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (IBM Advisory).

IBM has released patched versions across all affected release streams. Organizations should upgrade to the following fixed versions: LTS: 9.1.0.38 or later, 9.2.0.44 or later, 9.3.0.42 or later, 9.4.0.26 or later; Continuous Delivery: 9.3.5.2 or later, 9.4.5.2 or later, 10.0.0.1 or later. As interim mitigations, restrict network access to MQ cluster communication ports to only authorized cluster members, and implement network segmentation to limit which systems can connect to the MQ cluster (IBM Advisory, IBM MQ Operator Advisory).