CVE-2026-12354: IBM MQ RCE Vulnerability

CVE-2026-12354 Overview

CVE-2026-12354 is a JNDI injection vulnerability in IBM MQ affecting the Resource Adapter Installation Verification Test application. The flaw stems from improper validation of Java Naming and Directory Interface (JNDI) names [CWE-913]. An authenticated attacker with network access can leverage this weakness to execute arbitrary code on the application server hosting the IBM MQ resource adapter. The vulnerability spans multiple IBM MQ release trains, including Long Term Support (LTS) and Continuous Delivery (CD) branches.

Critical Impact
Authenticated attackers can execute arbitrary code on the application server through unsafe JNDI name resolution in the IBM MQ Resource Adapter test application.

Affected Products

IBM MQ 9.1.0.0 through 9.1.0.37 LTS and 9.2.0.0 through 9.2.0.43 LTS
IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, and 9.4.0.0 through 9.4.5.1 CD
IBM MQ 10.0.0.0

Discovery Timeline

2026-09-15 - CVE-2026-12354 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-12354

Vulnerability Analysis

The vulnerability resides in the Resource Adapter Installation Verification Test (IVT) application shipped with IBM MQ. This test application accepts JNDI names as input to verify resource adapter connectivity. The application does not validate or restrict these JNDI names before passing them to the naming service lookup.

An authenticated attacker can supply a crafted JNDI name that references an attacker-controlled remote endpoint. When the application resolves the name, it can trigger loading and instantiation of remote objects, resulting in arbitrary code execution in the application server process. The CWE-913 classification reflects improper control of dynamically-managed code resources.

Root Cause

The root cause is missing allowlist enforcement on JNDI lookup targets within the IVT application. JNDI providers such as Lightweight Directory Access Protocol (LDAP) and Remote Method Invocation (RMI) can deserialize or dereference remote objects during name resolution. Without validation of the scheme, host, or object factory returned, the lookup path becomes an execution primitive.

Attack Vector

Exploitation requires network access to the application server and valid authentication credentials to reach the Resource Adapter IVT interface. The attacker submits a JNDI name pointing to a hostile LDAP or RMI service under their control. The service returns a reference to a malicious object factory, which the Java runtime loads and executes within the application server context.

No verified public exploit code is available. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-12354

Indicators of Compromise

Outbound LDAP, LDAPS, or RMI connections originating from the IBM MQ application server process to unexpected external hosts.
Java class loading events referencing remote codebases or unfamiliar object factories within the MQ resource adapter runtime.
Unexpected child processes spawned by the application server JVM hosting the IBM MQ Resource Adapter IVT application.

Detection Strategies

Inspect application server access logs for requests to the Resource Adapter IVT endpoints that include JNDI name parameters with ldap://, ldaps://, rmi://, or iiop:// schemes.
Correlate authentication events against the MQ management interfaces with subsequent outbound network activity from the JVM process.
Deploy behavioral analytics to flag JVM processes that deviate from baseline network egress patterns.

Monitoring Recommendations

Enable verbose JNDI and naming service logging within the application server hosting IBM MQ resource adapters.
Forward JVM, application server, and network egress telemetry to a centralized data lake for retrospective hunting.
Alert on any invocation of the Resource Adapter IVT application in production environments where it should be disabled.

How to Mitigate CVE-2026-12354

Immediate Actions Required

Apply the IBM security update referenced on the IBM Support Page for the affected LTS, CD, and 10.0.0.0 release trains.
Remove or disable the Resource Adapter Installation Verification Test application in production deployments where it is not required.
Rotate credentials for accounts authorized to reach IBM MQ administrative and test interfaces.

Patch Information

IBM has published remediation guidance covering IBM MQ 9.1.0, 9.2.0, 9.3.0 LTS, 9.3 CD, 9.4.0 LTS, 9.4 CD, and 10.0.0.0. Refer to the IBM Support Page for fix pack identifiers and interim fix availability per version.

Workarounds

Restrict network access to the Resource Adapter IVT endpoint using firewall rules or application server security constraints.
Configure the JVM to disable remote codebase loading by setting com.sun.jndi.ldap.object.trustURLCodebase and com.sun.jndi.rmi.object.trustURLCodebase to false.
Enforce egress filtering from the application server to prevent outbound LDAP and RMI connections to untrusted destinations.

bash

# Configuration example - disable remote codebase loading in the JVM
java \
  -Dcom.sun.jndi.ldap.object.trustURLCodebase=false \
  -Dcom.sun.jndi.rmi.object.trustURLCodebase=false \
  -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false \
  -jar application-server.jar