CVE-2026-12351: IBM MQ RCE Vulnerability

CVE-2026-12351 Overview

CVE-2026-12351 is a remote code execution vulnerability in IBM MQ affecting multiple LTS and CD releases. The flaw resides in unsafe Java Naming and Directory Interface (JNDI) lookup processing performed when the Installation Verification Test (IVT) application is deployed. A remote, unauthenticated attacker can coerce the IVT application into resolving an attacker-controlled JNDI reference, leading to arbitrary code execution in the context of the MQ process. The weakness is classified under [CWE-74] (improper neutralization of special elements in output).

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on IBM MQ hosts running the vulnerable IVT application, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

• IBM MQ 9.3.0.0 through 9.3.0.41 LTS
• IBM MQ 9.3.0.0 through 9.3.5.1 CD, and 9.4.0.0 through 9.4.0.25 LTS
• IBM MQ 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0

Discovery Timeline

• 2026-09-15 - CVE-2026-12351 published to the National Vulnerability Database
• 2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-12351

Vulnerability Analysis

The vulnerability originates in the IBM MQ Installation Verification Test (IVT) application, a sample utility packaged with MQ to validate broker installations. When deployed, the IVT application performs JNDI lookups on data influenced by remote input without restricting the allowed naming providers or object factories. An attacker who can direct the IVT application to resolve a crafted JNDI URI, such as ldap:// or rmi:// targeting attacker infrastructure, causes the JVM to fetch and instantiate a remote Java class. The resulting object is loaded into the MQ process, giving the attacker code execution with the privileges of the MQ runtime user. This pattern mirrors the class of injection weaknesses tracked under [CWE-74] and is the same mechanism exploited in prior high-impact JNDI-based flaws.

Root Cause

The root cause is missing validation and restriction of JNDI providers within the IVT sample application. The affected code does not enforce trusted context filtering, does not disable remote codebase loading, and does not constrain object factories to a safe allow-list. Any deployment of the IVT application therefore exposes the broker to unsafe deserialization and remote class loading through JNDI.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker sends input to the deployed IVT application that reaches the vulnerable JNDI lookup routine. The JVM contacts an attacker-hosted LDAP or RMI server, retrieves a malicious reference, and instantiates the returned class inside the MQ JVM. Refer to the IBM Support Article for authoritative technical detail on affected code paths and fixes.

Detection Methods for CVE-2026-12351

Indicators of Compromise

• Outbound connections from IBM MQ hosts to unexpected LDAP (389, 636) or RMI (1099) endpoints, especially to external IP ranges.
• Java child processes spawned by the MQ JVM executing shells, curl, wget, or PowerShell commands.
• Unexpected class files or JARs written under IBM MQ installation directories or temp paths.
• MQ log entries showing IVT application activity on production systems where IVT should not be deployed.

Detection Strategies

• Inventory MQ installations to identify any host where the IVT application is deployed, then treat those hosts as high risk until patched.
• Inspect application and JVM logs for javax.naming.InitialContext lookups sourced from remote input.
• Correlate egress network telemetry with MQ process identifiers to surface anomalous LDAP or RMI traffic.

Monitoring Recommendations

• Alert on any process descended from the MQ JVM that executes command interpreters or downloads remote payloads.
• Monitor for creation of new class loaders or dynamic class definitions in MQ JVM audit logs.
• Track authentication and configuration changes to MQ queue managers following any suspicious network event.

How to Mitigate CVE-2026-12351

Immediate Actions Required

• Undeploy the IVT sample application from all production IBM MQ installations, as it is not required for normal broker operation.
• Apply IBM's fix packs for affected 9.3.x, 9.4.x, and 10.0.0.0 releases as listed in the vendor advisory.
• Restrict outbound network access from MQ hosts to only required destinations to block JNDI callback channels.

Patch Information

IBM has published fixes and remediation guidance in the IBM Support Article. Upgrade to the fixed LTS and CD levels identified in that advisory and validate that the IVT application is removed or replaced with the patched version.

Workarounds

• Remove the IVT application from MQ installations until the fix pack can be applied.
• Set JVM properties com.sun.jndi.ldap.object.trustURLCodebase=false and com.sun.jndi.rmi.object.trustURLCodebase=false to block remote codebase loading.
• Enforce egress filtering that denies LDAP and RMI traffic from MQ hosts to untrusted networks.

# Configuration example
# Disable remote codebase loading in the MQ JVM
export IBM_JAVA_OPTIONS="-Dcom.sun.jndi.ldap.object.trustURLCodebase=false \
  -Dcom.sun.jndi.rmi.object.trustURLCodebase=false \
  -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false"