CVE-2026-11725: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-11725 is an integer overflow vulnerability in IBM MQ's MQINQ request processing that allows an authenticated remote attacker to cause a denial of service or potentially execute arbitrary code. It affects IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS and 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS and 9.4.5.1 CD, and 10.0.0.0, as well as IBM MQ Operator and Queue Manager container images. The vulnerability was published on September 18, 2026, with patches made available by IBM shortly thereafter. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, IBM Advisory).

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound), mapped to CAPEC-92 (Forced Integer Overflow). The flaw resides in IBM MQ's handling of MQINQ (Message Queue Inquiry) requests, where insufficient bounds checking on an integer value allows it to overflow or wrap around, potentially corrupting memory or altering program control flow. Exploitation requires network access and valid (low-privilege) credentials to submit a crafted MQINQ request to the MQ service; no user interaction is needed. No public proof-of-concept code has been identified at this time (GitHub Advisory, IBM Advisory).

Successful exploitation can result in a crash of the IBM MQ service (denial of service) or, in more severe scenarios, arbitrary code execution with the privileges of the MQ process. Given the high confidentiality, integrity, and availability impact ratings, a successful code execution attack could expose sensitive message data transiting through MQ, allow unauthorized modification of queue configurations or messages, and disrupt business-critical messaging infrastructure. The scope is limited to the affected MQ component, but lateral movement within enterprise environments is plausible if the MQ process holds elevated system privileges (GitHub Advisory, IBM Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of this report. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for authenticated access. The EPSS score is approximately 0.405% (32nd percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, IBM Advisory).

IBM has released patches addressing this vulnerability; administrators should upgrade to fixed versions beyond the affected ranges (i.e., above 9.1.0.37 LTS, 9.2.0.43 LTS, 9.3.0.41 LTS, 9.3.5.1 CD, 9.4.0.25 LTS, 9.4.5.1 CD, and 10.0.0.0). For IBM MQ Operator and container image deployments, refer to the dedicated container advisory. As interim mitigations, restrict network access to IBM MQ services to only authenticated users who require it, implement network segmentation to limit exposure of MQ endpoints, and monitor MQ logs for anomalous MQINQ request patterns (IBM Advisory, IBM Container Advisory).

A brief mention of the vulnerability appeared on Mastodon via The Hacker Wire shortly after disclosure, indicating modest community awareness. No significant researcher commentary, detailed blog posts, or major media coverage has been identified beyond standard vulnerability database aggregation (IBM Advisory).