CVE-2026-10858: IBM MQ for HPE NonStop RCE Vulnerability

CVE-2026-10858 Overview

CVE-2026-10858 is a heap buffer underflow vulnerability [CWE-122] affecting IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40. The flaw resides in the message queue's multi-segment message processing logic. An authenticated attacker with network access can trigger the underflow to cause a denial of service or potentially execute arbitrary code on the affected system.

Critical Impact

Successful exploitation allows an authenticated remote attacker to crash the IBM MQ service or execute arbitrary code, with a scope change that impacts confidentiality, integrity, and availability of adjacent components.

Affected Products

• IBM MQ for HPE NonStop 8.1.0
• IBM MQ for HPE NonStop versions through 8.1.0.40
• Deployments processing multi-segment messages on HPE NonStop platforms

Discovery Timeline

• 2026-09-18 - CVE-2026-10858 published to the National Vulnerability Database
• 2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-10858

Vulnerability Analysis

The vulnerability originates in the code path that handles multi-segment messages within IBM MQ for HPE NonStop. When the server reassembles or parses segmented message payloads, an out-of-bounds heap access occurs before the start of an allocated buffer. This heap buffer underflow condition corrupts adjacent heap metadata or in-scope data structures.

An attacker with valid MQ credentials can craft malformed multi-segment messages to trigger the condition. Because the CVSS scope is changed, exploitation can affect resources beyond the vulnerable component itself. Outcomes range from service crashes to arbitrary code execution in the context of the MQ process.

The issue is tracked under CWE-122: Heap-based Buffer Overflow, which encompasses underflow conditions where writes or reads occur outside allocated heap boundaries.

Root Cause

The root cause is missing or incorrect boundary validation on message segment offsets and lengths during reassembly. When segment metadata references memory positions preceding the buffer start, the code dereferences the invalid pointer without validating the underflow condition.

Attack Vector

The attack vector is network-based and requires low-privilege authentication to the MQ queue manager. An attacker submits crafted multi-segment messages to a queue accessible with the compromised credentials. No user interaction is required. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-10858

Indicators of Compromise

• Unexpected termination or restart of IBM MQ queue manager processes on HPE NonStop hosts
• Core dumps or FDC (First Failure Data Capture) files referencing message segment reassembly functions
• Anomalous volumes of segmented messages from a single authenticated client identity
• MQ error logs containing memory faults or abnormal disconnections during PUT/GET operations

Detection Strategies

• Monitor IBM MQ error logs (AMQERR01.LOG) for repeated abnormal termination events tied to specific channel connections
• Correlate authentication events with subsequent queue manager crashes to identify malicious clients
• Baseline normal multi-segment message sizes and flag statistical outliers submitted by application identities

Monitoring Recommendations

• Enable MQ channel authentication auditing and forward events to a centralized logging platform
• Track queue manager process uptime and alert on unexpected restarts
• Inspect network traffic to MQ listener ports (default 1414) for anomalous segmented message patterns

How to Mitigate CVE-2026-10858

Immediate Actions Required

• Inventory all IBM MQ for HPE NonStop deployments and identify instances running versions 8.1.0 through 8.1.0.40
• Apply the IBM-provided fix as documented on the vendor advisory before resuming untrusted client connectivity
• Rotate credentials for MQ users with PUT permissions on affected queues if compromise is suspected
• Restrict network reachability of MQ listener ports to trusted application hosts only

Patch Information

IBM has published remediation guidance for this vulnerability. Consult the IBM Support Page for CVE-2026-10858 for the specific fix pack, APAR reference, and upgrade path applicable to your IBM MQ for HPE NonStop deployment.

Workarounds

• Enforce strict channel authentication records (CHLAUTH) to limit which user identities may connect and PUT messages
• Apply granular MQ object authority (setmqaut) so only required identities can write to queues that accept segmented messages
• Deploy network segmentation and firewall rules to restrict access to MQ listener ports from untrusted zones
• Disable or restrict application queues that accept multi-segment messages from lower-trust clients until patching completes

# Example: restrict channel access using CHLAUTH to a trusted application host
runmqsc QMGR_NAME <<EOF
SET CHLAUTH('APP.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('10.10.20.0/24') USERSRC(CHANNEL) ACTION(REPLACE)
SET CHLAUTH('APP.SVRCONN') TYPE(BLOCKUSER) USERLIST('*MQADMIN') ACTION(REPLACE)
REFRESH SECURITY TYPE(CONNAUTH)
EOF