IBM MQ Java Client Deserialization Filter Bypass Enables Code Exec
CVE-2026-10751 Published on September 18, 2026

IBM MQ Java messaging is vulnerable to remote code execution
IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-10751 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Marshaling, Unmarshaling Vulnerability?

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVE-2026-10751 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.


Products Associated with CVE-2026-10751

Want to know whenever a new CVE is published for IBM Mq? stack.watch will email you.

IBM Mq
 

Affected Versions

IBM MQ: