CVE-2026-11375: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-11375 is a heap-based buffer overflow vulnerability in IBM MQ that allows an authenticated attacker to cause a denial of service or potentially execute arbitrary code by sending maliciously crafted XA transaction identifiers. It affects IBM MQ across multiple release tracks: LTS versions 9.1.0.0–9.1.0.37, 9.2.0.0–9.2.0.43, 9.3.0.0–9.3.0.41, and 9.4.0.0–9.4.0.25; Continuous Delivery versions 9.3.0.0–9.3.5.1, 9.4.0.0–9.4.5.1; and version 10.0.0.0. The vulnerability was published on September 18, 2026, with patches referenced in IBM's security bulletins. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, IBM Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), occurring when IBM MQ processes XA transaction identifiers without adequate bounds checking, allowing attacker-controlled data to overflow a heap-allocated buffer. Despite the CVE description referencing a "stack buffer overflow," the official CWE classification and GitHub Advisory identify it as a heap-based overflow. An authenticated, low-privileged attacker can exploit this remotely over the network with no user interaction required, by submitting a specially crafted XA transaction identifier to the MQ service. No public proof-of-concept code has been identified at this time (GitHub Advisory, IBM Advisory).

Successful exploitation can result in a complete compromise of the affected IBM MQ instance, with high impact to confidentiality, integrity, and availability. An attacker could crash the MQ service (denial of service) or execute arbitrary code with the privileges of the MQ process, potentially enabling access to sensitive message data, manipulation of message queues, and lateral movement within enterprise environments that rely on IBM MQ for critical business messaging (GitHub Advisory, IBM Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of publication. The EPSS score is approximately 0.346% (26th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and SSVC assessment notes exploitation as "none" with no automation feasibility (GitHub Advisory, IBM Advisory).

IBM has released patches addressing this vulnerability; organizations should apply the relevant fix pack for their release track. Recommended remediation steps include:

• LTS tracks: Upgrade IBM MQ 9.1.x to a version beyond 9.1.0.37, 9.2.x beyond 9.2.0.43, 9.3.x beyond 9.3.0.41, and 9.4.x beyond 9.4.0.25.
• CD tracks: Upgrade IBM MQ 9.3.x CD beyond 9.3.5.1, 9.4.x CD beyond 9.4.5.1, and 10.0.0.0 to a patched release.
• Restrict MQ access to trusted, authorized users and minimize the number of accounts with MQ privileges.
• Implement network segmentation to limit access to MQ services from untrusted networks.
• Monitor for unusual XA transaction processing activity as a compensating control until patching is complete (IBM Advisory, IBM MQ Operator Bulletin).

Heise Online covered the vulnerability in an article titled "IBM MQ: In several cases malicious code can reach systems," noting the risk of code execution via the buffer overflow (Heise Article). General community reaction has been moderate, with aggregator sites such as VulDB and CVEFeed tracking the issue shortly after disclosure. No significant researcher commentary or threat actor attribution has been publicly reported.