Loading vulnerability…
IBM MQ Insecure Deserialization Remote Code Execution
CVE-2026-12728 is an insecure deserialization vulnerability in IBM MQ Java messaging. IBM MQ releases 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 Continuous Delivery, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 Continuous Delivery, and 10.0.0.0 deserialize untrusted data. An authenticated attacker can supply malicious serialized input to trigger arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution in the context of the affected IBM MQ component. The vulnerability has high confidentiality, integrity, and availability impact, enabling an attacker to access or disclose data, modify data or processing, and disrupt IBM MQ services.
If you can’t patch tonight, do this now.
Avoid deserializing untrusted data and apply input validation to serialized data sources. Restrict network access to IBM MQ interfaces and limit access to authenticated accounts with the privileges necessary to reach Java messaging functionality until patched.
Patch, then assume compromise.
Update IBM MQ to a release containing IBM's security fixes for CVE-2026-12728. IBM published a patch on 2026-09-14; fixed target versions are not specified here.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.