{"api_version":"1","generated_at":"2026-10-29T02:20:24+00:00","cve":"CVE-2026-12355","urls":{"html":"https://cve.report/CVE-2026-12355","api":"https://cve.report/api/cve/CVE-2026-12355.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-12355","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12355"},"summary":{"title":"IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution","description":"IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-09-15 18:17:13","updated_at":"2026-09-16 04:17:54"},"problem_types":["CWE-74","CWE-74 CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7284912","name":"https://www.ibm.com/support/pages/node/7284912","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12355","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12355","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"MQ","version":"affected 9.1.0.0 9.1.0.37 LTS semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ","version":"affected 9.2.0.0 9.2.0.43 LTS semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ","version":"affected 9.3.0.0 9.3.0.41 LTS semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ","version":"affected 9.3.0.0 9.3.5.1 CD semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ","version":"affected 9.4.0.0 9.4.0.25 LTS semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ","version":"affected 9.4.0.0 9.4.5.1 CD semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ","version":"affected 10.0.0.0","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"This issue was addressed under Known Issue DT473764\n\n\n\nIBM MQ version 9.1 LTS\n\n\n\n Apply cumulative security update 9.1.0.38 https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts \n\n\n\nIBM MQ version 9.2 LTS\n\n\n\n Apply cumulative security update 9.2.0.44 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts \n\n\n\nIBM MQ version 9.3 LTS\n\n\n\n Apply cumulative security update 9.3.0.42 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts \n\n\n\nIBM MQ version 9.4 LTS\n\n\n\n Apply cumulative security update https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts   9.4.0.26 https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts \n\n\n\nIBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0\n\n\n\n Upgrade to IBM MQ version 10.0.0.5 https://www.ibm.com/support/pages/downloading-ibm-mq-100","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"12355","cve":"CVE-2026-12355","epss":"0.003800000","percentile":"0.317130000","score_date":"2026-09-16","updated_at":"2026-09-17 00:07:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-12355","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-15T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-16T03:56:37.380Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.1.0.37:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.2.0.43:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.41:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.25:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.5.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:10.0.0.0:*:*:*:*:*:*:*"],"product":"MQ","vendor":"IBM","versions":[{"lessThanOrEqual":"9.1.0.37 LTS","status":"affected","version":"9.1.0.0","versionType":"semver"},{"lessThanOrEqual":"9.2.0.43 LTS","status":"affected","version":"9.2.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.0.41 LTS","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.5.1 CD","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.0.25 LTS","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.5.1 CD","status":"affected","version":"9.4.0.0","versionType":"semver"},{"status":"affected","version":"10.0.0.0"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution.</p>"}],"value":"IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-15T17:12:54.699Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7284912"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>This issue was addressed under Known Issue DT473764</p><p>IBM MQ version 9.1 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update 9.1.0.38</a></p><p>IBM MQ version 9.2 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update 9.2.0.44</a></p><p>IBM MQ version 9.3 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update 9.3.0.42</a></p><p>IBM MQ version 9.4 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update</a><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\" rel=\"noopener noreferrer nofollow\"> 9.4.0.26</a></p><p>IBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-100\" rel=\"noopener noreferrer nofollow\">Upgrade to IBM MQ version 10.0.0.5</a></p>"}],"value":"This issue was addressed under Known Issue DT473764\n\n\n\nIBM MQ version 9.1 LTS\n\n\n\n Apply cumulative security update 9.1.0.38 https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts \n\n\n\nIBM MQ version 9.2 LTS\n\n\n\n Apply cumulative security update 9.2.0.44 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts \n\n\n\nIBM MQ version 9.3 LTS\n\n\n\n Apply cumulative security update 9.3.0.42 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts \n\n\n\nIBM MQ version 9.4 LTS\n\n\n\n Apply cumulative security update https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts   9.4.0.26 https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts \n\n\n\nIBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0\n\n\n\n Upgrade to IBM MQ version 10.0.0.5 https://www.ibm.com/support/pages/downloading-ibm-mq-100"}],"title":"IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-12355","datePublished":"2026-09-15T17:12:54.699Z","dateReserved":"2026-06-15T21:47:43.112Z","dateUpdated":"2026-09-16T03:56:37.380Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-15 18:17:13","lastModifiedDate":"2026-09-16 04:17:54","problem_types":["CWE-74","CWE-74 CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-15T00:00:00+00:00","id":"CVE-2026-12355","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"12355","Ordinal":"1","Title":"IBM MQ Resource Adapter IVT servlet is vulnerable to unauthentic","CVE":"CVE-2026-12355","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"12355","Ordinal":"1","NoteData":"IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution.","Type":"Description","Title":"IBM MQ Resource Adapter IVT servlet is vulnerable to unauthentic"}]}}}