CVE-2025-0985: IBM MQ Information Disclosure Vulnerability

CVE-2025-0985 Overview

CVE-2025-0985 is an information exposure vulnerability affecting IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD. The product stores potentially sensitive information in environment variables that a local user can retrieve. The weakness is tracked under [CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable].

A local, authenticated user with low privileges can read process environment variables and recover data that should have remained protected. Exploitation does not affect integrity or availability but exposes confidential data usable for follow-on attacks against the messaging infrastructure.

Critical Impact
A local user on a system running IBM MQ can access sensitive information stored in environment variables, potentially exposing credentials or configuration data used by the queue manager.

Affected Products

IBM MQ 9.3 LTS
IBM MQ 9.3 CD and 9.4 CD (Continuous Delivery)
IBM MQ 9.4 LTS

Discovery Timeline

2025-02-28 - CVE-2025-0985 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0985

Vulnerability Analysis

IBM MQ processes place sensitive values into environment variables during runtime. On Unix-like systems, any local user can inspect the environment of processes they own through /proc/<pid>/environ, and administrative or co-located accounts can inspect additional processes. On Windows, tools that enumerate process environment blocks expose the same data.

The vulnerability requires local access and low privileges, and no user interaction is needed. Exploitation impacts confidentiality only. Integrity and availability of the queue manager are not affected by this issue.

The exposed data can include configuration secrets or credentials used by IBM MQ components. Recovered values may enable an attacker to authenticate against queue managers, decrypt channel traffic, or pivot into connected applications relying on the same secrets.

Root Cause

The root cause is the placement of sensitive values in environment variables rather than in access-controlled storage such as protected files, keystores, or in-memory secret vaults. Environment variables inherit down process trees and are readable by adjacent local principals, which violates the confidentiality boundary the data requires.

Attack Vector

An attacker with a local shell and standard user privileges enumerates running IBM MQ processes and reads their environment blocks. On Linux, this is typically achieved by reading /proc/<pid>/environ for processes owned by the same user or by leveraging shared administrative context. Retrieved strings are then parsed for tokens, passwords, or configuration secrets.

No network access, no user interaction, and no elevated privileges beyond a valid local account are required. The attack does not generate anomalous MQ protocol traffic, which limits network-side visibility.

Detection Methods for CVE-2025-0985

Indicators of Compromise

Unexpected read access to /proc/<pid>/environ files belonging to IBM MQ processes such as amqzxma0, amqzmuc0, or runmqlsr.
Local user shells enumerating running MQ processes with ps -eww, cat /proc/*/environ, or PowerShell equivalents that dump process environment blocks.
Off-hours access from non-administrative accounts to directories owned by the mqm user or group.

Detection Strategies

Deploy auditd rules on Linux to log reads of /proc/*/environ for processes owned by the mqm user and alert on non-mqm, non-root access.
On Windows, monitor for use of tools such as Process Explorer, Get-Process | Select-Object StartInfo, and WMI queries retrieving environment blocks of MQ services.
Correlate local logon events with process enumeration activity against IBM MQ binaries to surface reconnaissance behavior.

Monitoring Recommendations

Forward host telemetry, including process access and file read events, to a centralized analytics pipeline for cross-host correlation.
Baseline which accounts legitimately interact with the mqm user context and alert on deviations.
Review IBM MQ authentication logs for successful logins that follow suspicious local process inspection on the same host.

How to Mitigate CVE-2025-0985

Immediate Actions Required

Apply the fix documented in the IBM Security Advisory for IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD.
Rotate any credentials, API tokens, or configuration secrets that were previously supplied to IBM MQ through environment variables.
Restrict interactive and shell access on hosts running IBM MQ to the minimum set of administrators.

Patch Information

IBM has published remediation guidance in the IBM Security Advisory. Administrators should upgrade IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD to the fix levels listed by IBM and verify that queue managers restart cleanly after the update.

Workarounds

Move sensitive values from environment variables into IBM MQ-supported credential stores or protected configuration files with strict file permissions.
Harden host access controls so that only the mqm account and authorized administrators can enumerate IBM MQ processes.
On Linux, mount /proc with the hidepid=2 option to prevent unprivileged users from inspecting other users' process environments.

bash

# Restrict /proc visibility so users can only see their own processes
sudo mount -o remount,rw,hidepid=2,gid=mqm /proc

# Persist the setting in /etc/fstab
proc /proc proc defaults,hidepid=2,gid=mqm 0 0