CVE-2026-12728: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-12728 is a deserialization of untrusted data vulnerability in IBM MQ that allows authenticated remote attackers to execute arbitrary code. It affects IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0. The vulnerability was published on September 15, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, IBM Support).

The root cause is improper deserialization of untrusted data (CWE class: Deserialization of Untrusted Data) within IBM MQ's processing logic. An attacker with low-privilege network access can send crafted serialized data to the IBM MQ service, which upon deserialization triggers arbitrary code execution on the server. The attack vector is network-based, requires low privileges (authenticated access), no user interaction, and low attack complexity, making it straightforward to exploit once credentials are obtained. No specific CWE identifier or public proof-of-concept code has been disclosed at this time (GitHub Advisory, IBM Support).

Successful exploitation grants an authenticated attacker full remote code execution on the IBM MQ server, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive message queue data, tamper with or destroy messages in transit, disrupt MQ services, and potentially use the compromised MQ server as a pivot point for lateral movement within enterprise environments. Given IBM MQ's role as critical middleware in financial, healthcare, and enterprise infrastructure, a successful attack could have significant downstream consequences (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable, as it requires authenticated access. The EPSS score is approximately 0.59% (47th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (Feedly).

IBM has released patches addressing this vulnerability; users should update to fixed versions beyond the affected ranges: above 9.1.0.37 LTS, 9.2.0.43 LTS, 9.3.0.41 LTS, 9.3.5.1 CD, 9.4.0.25 LTS, 9.4.5.1 CD, and 10.0.0.0 respectively. As interim mitigations, organizations should implement network segmentation to restrict access to IBM MQ services to only authorized systems, and limit user accounts with MQ access to those with a verified business need. Additional controls such as application-level input validation and serialization filtering should be considered where feasible (IBM Support, GitHub Advisory).