CVE-2026-10027: IBM MQ RCE Vulnerability

CVE-2026-10027 Overview

CVE-2026-10027 is a buffer overflow vulnerability in IBM MQ that allows a remote, unauthenticated attacker to trigger denial of service or execute arbitrary code. The flaw affects channels configured with compression enabled and is triggered when the queue manager processes malformed compressed data. IBM MQ acts as enterprise messaging middleware, so exploitation targets the queue manager service directly over the network. The weakness is classified as an out-of-bounds write [CWE-787].

Critical Impact
A single crafted compressed message sent to a compression-enabled channel can crash the queue manager or lead to arbitrary code execution within the MQ service context, compromising message confidentiality, integrity, and availability.

Affected Products

IBM MQ Long Term Support (LTS) releases
IBM MQ Continuous Delivery (CD) releases
IBM MQ 10.0.0.0 (Continuous Delivery)

Discovery Timeline

2026-09-18 - CVE-2026-10027 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-10027

Vulnerability Analysis

IBM MQ channels can be configured to compress message headers and payloads to reduce network bandwidth. The vulnerability resides in the code path that decompresses inbound channel data on the queue manager side. When a crafted compressed stream declares length or offset metadata inconsistent with the actual decompressed content, the decompression routine writes past the end of a fixed-size buffer.

This out-of-bounds write [CWE-787] corrupts adjacent memory in the MQ listener or channel agent process. Depending on which structures are overwritten, the outcome ranges from queue manager termination to controlled hijack of execution flow. Because IBM MQ often runs with elevated privileges and is reachable across trust boundaries, successful code execution provides a strong pivot into messaging fabrics.

Root Cause

The root cause is missing or insufficient bounds validation on decompressed data lengths before the decompressed bytes are copied into destination buffers. The channel compression negotiation happens before authentication completes on the data channel, which is why the issue is exploitable without valid credentials.

Attack Vector

Exploitation is network-based and requires no user interaction or prior authentication. An attacker sends malformed compressed frames to a listener port (typically TCP 1414 or another configured MQ listener) on a channel that has COMPMSG or COMPHDR compression negotiated. Any channel with compression enabled is a candidate target, including SVRCONN, RCVR, and CLUSRCVR channel types.

No verified public exploit code is available for CVE-2026-10027. Refer to the IBM Support advisory for CVE-2026-10027 for authoritative technical details.

Detection Methods for CVE-2026-10027

Indicators of Compromise

Unexpected termination or FDC (First Failure Data Capture) files generated by amqzlaa0, amqrmppa, or channel agent processes on the queue manager host.
Channel status transitions to RETRYING or STOPPED on compression-enabled channels shortly after inbound connections from unusual source addresses.
New child processes spawned by the MQ service account (mqm on Unix, MUSR_MQADMIN or service SID on Windows) following remote connections.
Egress network connections initiated by MQ processes to non-broker destinations.

Detection Strategies

Monitor MQ error logs (AMQERR01.LOG) for repeated abends, segmentation faults, or decompression errors tied to specific channels or remote peers.
Alert on any process crash of the queue manager listener or runmqlsr followed by automatic restart within short intervals.
Inspect channel definitions for COMPMSG or COMPHDR values other than NONE and correlate traffic to those channels with process crash telemetry.

Monitoring Recommendations

Enable endpoint telemetry on all queue manager hosts to capture process creation, memory-corruption crash signatures, and outbound connections from MQ binaries.
Forward MQ error logs and channel status events into a SIEM or data lake for correlation with network flow data.
Baseline expected client IP ranges per channel and alert on anomalous sources connecting to compression-enabled channels.

How to Mitigate CVE-2026-10027

Immediate Actions Required

Apply the IBM MQ security update referenced in the IBM Support advisory for CVE-2026-10027 as soon as your change window permits.
Inventory all queue managers and enumerate channels with COMPMSG or COMPHDR set to anything other than NONE.
Restrict inbound access to MQ listener ports at the network layer to known client subnets until patching is complete.
Review MQ error logs for prior crash indicators that may signal pre-patch exploitation attempts.

Patch Information

IBM has published fix information on the IBM Support advisory for CVE-2026-10027. Apply the interim fix or fix pack that corresponds to your IBM MQ LTS or CD release. Both LTS and Continuous Delivery streams, including IBM MQ 10.0.0.0 CD, are in scope for remediation.

Workarounds

Disable channel compression by setting COMPMSG(NONE) and COMPHDR(NONE) on all channel definitions where compression is not strictly required.
Enforce TLS and mutual authentication (SSLCAUTH(REQUIRED)) on channels to limit which peers can negotiate a data channel.
Apply Channel Authentication Records (CHLAUTH) rules to block unknown source addresses from connecting to SVRCONN and receiver channels.

bash

# Configuration example: disable compression on an existing channel via runmqsc
runmqsc QMGR_NAME <<EOF
ALTER CHANNEL(MY.SVRCONN) CHLTYPE(SVRCONN) COMPMSG(NONE) COMPHDR(NONE)
ALTER CHANNEL(MY.RCVR)    CHLTYPE(RCVR)    COMPMSG(NONE) COMPHDR(NONE)
REFRESH SECURITY TYPE(CONNAUTH)
EOF