CVE-2026-10744 Overview
CVE-2026-10744 affects IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40. The flaw resides in MQINQ request validation, where an integer overflow condition can be triggered by an authenticated attacker. Successful exploitation can lead to denial of service or potential privilege escalation within the messaging service. The weakness is classified under [CWE-122] (Heap-based Buffer Overflow), reflecting memory corruption downstream of the overflow.
Critical Impact
An authenticated network attacker can crash the IBM MQ queue manager or potentially escalate privileges on affected HPE NonStop deployments, disrupting enterprise messaging infrastructure.
Affected Products
- IBM MQ for HPE NonStop 8.1.0
- IBM MQ for HPE NonStop versions 8.1.0.1 through 8.1.0.40
- HPE NonStop platforms running the vulnerable MQ release train
Discovery Timeline
- 2026-09-18 - CVE-2026-10744 published to the National Vulnerability Database
- 2026-09-19 - Last updated in NVD database
Technical Details for CVE-2026-10744
Vulnerability Analysis
The vulnerability exists in the request validation logic that processes MQINQ (Inquire) API calls in IBM MQ for HPE NonStop. MQINQ is used by clients to query attributes of MQ objects such as queues, channels, and queue managers. During validation, an arithmetic operation on attacker-influenced size or count fields wraps past the maximum representable integer value. The resulting undersized allocation or miscalculated boundary leads to a heap-based memory corruption condition tracked as [CWE-122].
Because the attack path is network-reachable and requires only low-privileged authenticated access, any user permitted to submit MQ administrative or inquiry requests can reach the vulnerable code path. The attack complexity is high, reflecting timing or state conditions needed to reliably weaponize the overflow into privilege escalation rather than a crash.
Root Cause
The root cause is an integer overflow in the parameter validation routine handling MQINQ requests. When the server computes buffer sizes from attacker-controlled length or selector-count values, the arithmetic exceeds the width of the integer type used. Subsequent memory operations rely on the truncated value, producing heap corruption when the actual data written exceeds the allocated region.
Attack Vector
An attacker authenticates to the IBM MQ queue manager over the network. The attacker then submits a crafted MQINQ request with parameter values chosen to trigger integer wraparound during size validation. The queue manager allocates an undersized buffer and processes the request, corrupting adjacent heap memory. The most reliable outcome is a queue manager crash and denial of service. Under specific heap layouts, corruption of control structures may allow the attacker to influence execution flow and escalate privileges within the MQ process context.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No verified code examples are published; refer to the IBM Support Page for vendor technical details.
Detection Methods for CVE-2026-10744
Indicators of Compromise
- Unexpected amqzxma0, amqzlaa0, or equivalent NonStop MQ process crashes coinciding with authenticated client sessions
- Queue manager FDC (First Failure Data Capture) records referencing MQINQ handling or heap validation failures
- Repeated MQINQ calls from a single client identity with abnormally large or malformed selector arrays
- Sudden queue manager restarts or failover events without a corresponding administrative action
Detection Strategies
- Enable and centralize IBM MQ error logs (AMQERR01.LOG) and NonStop event logs, alerting on repeated abnormal terminations of MQ processes
- Monitor MQ channel authentication and command events for the same authenticated identity issuing high volumes of MQINQ calls
- Correlate network flows to MQ listener ports (default 1414/tcp) with authentication events to identify anomalous inquiry patterns
Monitoring Recommendations
- Ingest MQ and NonStop logs into a centralized analytics platform for baseline deviation analysis
- Alert on any queue manager crash followed by automatic restart, and preserve FDC files for forensic review
- Track privileged MQ identities and flag MQINQ bursts or malformed parameter patterns from those principals
How to Mitigate CVE-2026-10744
Immediate Actions Required
- Inventory all IBM MQ for HPE NonStop instances and confirm which are running versions 8.1.0 through 8.1.0.40
- Apply the IBM-supplied fix as documented on the IBM Support Page
- Restrict network access to MQ listener ports so only trusted application hosts can reach the queue manager
- Review MQ authorization records and remove unnecessary inquiry or administrative permissions from low-trust identities
Patch Information
IBM has published remediation guidance on the IBM Support Page for CVE-2026-10744. Administrators should apply the vendor-recommended fix pack or interim fix for IBM MQ for HPE NonStop 8.1.0 as directed by IBM. Validate the update in a non-production environment before rolling it into production queue managers.
Workarounds
- Enforce strict channel authentication records (CHLAUTH) to limit which users and IP ranges can connect to the queue manager
- Reduce granted authorities so untrusted principals cannot invoke MQINQ against sensitive objects
- Place the queue manager behind network segmentation that permits only vetted application traffic
- Increase log retention and enable rapid restart monitoring to shorten detection and recovery time if exploitation is attempted
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.