CVE-2026-11716: IBM MQ for HPE NonStop DOS Vulnerability

CVE-2026-11716 Overview

CVE-2026-11716 affects IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40. An authenticated attacker can trigger a denial of service or potentially execute arbitrary code during queue manager startup. The root cause is improper validation of cluster migration data processed by the queue manager. The flaw is classified under [CWE-122] as a heap-based buffer overflow. Successful exploitation compromises the confidentiality, integrity, and availability of the messaging infrastructure that many enterprise integration workloads depend on.

Critical Impact
Authenticated attackers can disrupt queue manager startup or execute arbitrary code on affected IBM MQ for HPE NonStop deployments, threatening enterprise messaging availability and integrity.

Affected Products

IBM MQ for HPE NonStop 8.1.0
IBM MQ for HPE NonStop versions 8.1.0.1 through 8.1.0.40
HPE NonStop platforms running the affected IBM MQ releases

Discovery Timeline

2026-09-18 - CVE-2026-11716 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-11716

Vulnerability Analysis

The defect resides in the code path that processes cluster migration data during queue manager (qmgr) startup. IBM MQ clusters share metadata between queue managers to coordinate routing, workload balancing, and channel state. When a queue manager starts, it consumes cluster migration records to reconstruct cluster context. Insufficient bounds checking on these records permits a heap-based buffer overflow, classified under [CWE-122].

The attacker must be authenticated to the environment, which limits pre-conditions but does not eliminate risk in shared enterprise messaging fabrics. Any principal able to influence cluster migration data can weaponize a malformed record. The outcome ranges from an aborted queue manager start (denial of service) to arbitrary code execution in the queue manager process context.

Root Cause

The queue manager fails to validate the size and structure of cluster migration data before copying it into a fixed heap allocation. An overlong or malformed field overwrites adjacent heap metadata and adjacent objects. This corruption can be leveraged to alter control flow during the startup routine.

Attack Vector

Exploitation is network-adjacent because IBM MQ clusters exchange data over MQ channels. An authenticated attacker plants malicious cluster migration data that the target queue manager consumes on its next startup. Because startup is a required lifecycle event, the payload triggers deterministically without additional user interaction. Refer to the IBM Support Page for vendor technical details.

No verified public proof-of-concept code is available for CVE-2026-11716 at the time of writing.

Detection Methods for CVE-2026-11716

Indicators of Compromise

Unexpected queue manager crashes or FDC (First Failure Data Capture) files generated during startup on IBM MQ for HPE NonStop 8.1.0.x
Abnormal cluster repository (SYSTEM.CLUSTER.*) update activity preceding queue manager restarts
Core dumps or heap corruption diagnostics referencing cluster migration processing routines

Detection Strategies

Monitor MQ error logs (AMQERR01.LOG) for repeated abnormal termination messages tied to strmqm or cluster reconciliation events
Alert on unauthorized modification of cluster channel definitions or repository queues by unexpected user identities
Correlate authenticated MQ administrative sessions with subsequent queue manager restarts to surface suspicious sequencing

Monitoring Recommendations

Enable MQ authorization event and command event messages to capture principal actions against cluster objects
Forward MQ logs and OS-level crash telemetry to a centralized SIEM for cross-source correlation
Baseline normal queue manager restart frequency and alert on statistically significant deviations

How to Mitigate CVE-2026-11716

Immediate Actions Required

Inventory all IBM MQ for HPE NonStop instances and identify systems running versions 8.1.0 through 8.1.0.40
Apply the vendor-supplied fix referenced on the IBM Support Page as soon as maintenance windows allow
Restrict administrative access to queue managers and cluster repository queues to a minimal set of authenticated principals

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should follow the vendor advisory to obtain the corrected IBM MQ for HPE NonStop package and apply it to every queue manager in the cluster, including full and partial repository queue managers.

Workarounds

Limit which principals can publish or modify cluster migration data by tightening MQ Object Authority Manager (OAM) permissions on cluster queues and channels
Isolate untrusted queue managers from production clusters until the patch is applied
Require mutual TLS on all cluster channels to prevent unauthenticated peers from injecting cluster data

bash

# Example: tighten authorization on the cluster transmission queue
setmqaut -m QMGR1 -t queue -n SYSTEM.CLUSTER.TRANSMIT.QUEUE \
  -p untrusted_user -all

# Example: enforce TLS on a cluster receiver channel
ALTER CHANNEL(TO.QMGR1) CHLTYPE(CLUSRCVR) \
  SSLCIPH(ANY_TLS13) SSLCAUTH(REQUIRED)