Loading vulnerability…
IBM MQ Resource Adapter JNDI Name Validation Code Execution
CVE-2026-12354 is an improper input-validation vulnerability in IBM MQ's Resource Adapter Installation Verification Test application. Insufficient validation of JNDI names may allow an authenticated attacker to supply a malicious JNDI name that results in arbitrary code execution on the application server. Affected versions include IBM MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41, 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25, 9.4 CD through 9.4.5.1, and 10.0.0.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution on the application server in the context of the affected application or service. This may result in high-impact compromise of confidentiality, integrity, and availability.
Patch, then assume compromise.
Apply IBM's security fix released for CVE-2026-12354 on 2026-09-14. Update IBM MQ to a vendor-fixed maintenance level appropriate for the deployed LTS or CD stream.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.