CVE-2026-12538 in MQ Appliance

Summary

by MITRE • 11/04/2026

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: Ibm
• Reservation: 06/17/2026
• Disclosure: 11/04/2026
• Moderation: accepted
• Entry: VDB-431200
• CPE: 20261104
• CWE: CWE-20 (confirmed)
• CVSS: 5.4 (CNA)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-12538
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12538
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-12538/