Loading vulnerability…
IBM MQ JMS Client Java Deserialization Allowlist Bypass RCE
CVE-2026-13293 is a high-severity insecure deserialization vulnerability in the IBM MQ JMS client Java messaging component. A bypass of the Java deserialization allowlist permits untrusted data in JMS ObjectMessages to be deserialized, enabling a remote authenticated attacker to execute arbitrary code on a consuming system. Affected releases are IBM MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41, 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25, 9.4 CD through 9.4.5.1, and 10.0.0.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution in the context of the affected IBM MQ JMS ObjectMessage-consuming system. Confidentiality, integrity, and availability impacts are rated High.
If you can’t patch tonight, do this now.
No workaround or mitigation is available. Apply the applicable IBM MQ security update or upgrade. Until patching is complete, restrict network access to MQ services and limit credentials capable of sending messages to queues consumed by JMS ObjectMessage consumers.
Patch, then assume compromise.
Apply IBM MQ cumulative security update 9.1.0.38 for 9.1 LTS, 9.2.0.44 for 9.2 LTS, 9.3.0.42 for 9.3 LTS, or 9.4.0.26 for 9.4 LTS. Users of IBM MQ 9.3 CD, 9.4 CD, and 10.0.0.0 should upgrade to IBM MQ 10.0.0.5.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.