CVE-2026-10747 - Vulnerability Details - OpenCVE

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Ibm	Mq Appliance

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7284690

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 18 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.
Title		IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing
First Time appeared		Ibm Ibm mq Appliance
Weaknesses		CWE-122
CPEs		cpe:2.3:a:ibm:mq_appliance:10.0.0.0:::::::* cpe:2.3:a:ibm:mq_appliance:10.0.0.1:::::::* cpe:2.3:a:ibm:mq_appliance:9.4.0.0:::::::* cpe:2.3:a:ibm:mq_appliance:9.4.0:::::::* cpe:2.3:a:ibm:mq_appliance:9.4.1.0:::::::* cpe:2.3:a:ibm:mq_appliance:9.4:::::::*
Vendors & Products		Ibm Ibm mq Appliance
References		https://www.ibm.com/support/pages/node/7284690
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-09-18T15:55:43.394Z

Updated: 2026-09-21T12:47:23.571Z

Reserved: 2026-06-03T13:39:03.419Z

Link: CVE-2026-10747

Vulnrichment

Updated: 2026-09-21T12:45:06.633Z

NVD

Status : Awaiting Analysis

Published: 2026-09-18T16:17:04.413

Modified: 2026-09-21T13:17:07.147

Link: CVE-2026-10747

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10747", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-06-03T13:39:03.419Z", "datePublished": "2026-09-18T15:55:43.394Z", "dateUpdated": "2026-09-21T12:47:23.571Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-18T15:55:43.394Z"}, "title": "IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "MQ Appliance", "versions": [{"status": "affected", "version": "9.4 LTS", "lessThanOrEqual": "9.4.0.0 to 9.4.0.25", "versionType": "custom"}, {"status": "affected", "version": "9.4 CD", "lessThanOrEqual": "9.4.1.0 to 9.4.5.2", "versionType": "custom"}, {"status": "affected", "version": "10.0.0.0", "lessThanOrEqual": "10.0.0.1 only", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:10.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:10.0.0.1:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7284690", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 10, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "This vulnerability is addressed under APAR DT472411\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\nIBM MQ Appliance version 9.4 LTS\nApply IBM MQ Appliance fix pack 9.4.0.26 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2003\nUpgrade to IBM MQ Appliance 10.0.0.5 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2002\nApply\u00a0 IBM MQ Appliance cumulative security update 9.4.5.3 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 10 LTS\nApply IBM MQ Appliance fix pack 10.0.0.5 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>This vulnerability is addressed under APAR DT472411</p><p>IBM strongly recommends addressing the vulnerability now.</p><p><strong>IBM MQ Appliance version 9.4 LTS</strong><br/>Apply <a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=9.4.0.26-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance fix pack 9.4.0.26</a>, or later firmware.</p><p><strong>IBM MQ Appliance version 9.4 CD - M2003</strong><br/>Upgrade to <a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=10.0.0.5-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance 10.0.0.5</a>, or later firmware.</p><p><strong>IBM MQ Appliance version 9.4 CD - M2002</strong><br/>Apply\u00a0<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=9.4.5.3-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance cumulative security update 9.4.5.3</a>, or later firmware.</p><p><strong>IBM MQ Appliance version 10 LTS</strong><br/>Apply <a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=10.0.0.5-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance fix pack 10.0.0.5</a>, or later firmware.</p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10747", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-19T03:56:46.797549Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T12:47:23.571Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10747", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-19T03:56:46.797549Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T12:45:06.633Z"}}], "cna": {"title": "IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:10.0.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:mq_appliance:10.0.0.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "MQ Appliance", "versions": [{"status": "affected", "version": "9.4 LTS", "versionType": "custom", "lessThanOrEqual": "9.4.0.0 to 9.4.0.25"}, {"status": "affected", "version": "9.4 CD", "versionType": "custom", "lessThanOrEqual": "9.4.1.0 to 9.4.5.2"}, {"status": "affected", "version": "10.0.0.0", "versionType": "semver", "lessThanOrEqual": "10.0.0.1 only"}]}], "solutions": [{"lang": "en", "value": "This vulnerability is addressed under APAR DT472411\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\nIBM MQ Appliance version 9.4 LTS\nApply IBM MQ Appliance fix pack 9.4.0.26 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2003\nUpgrade to IBM MQ Appliance 10.0.0.5 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2002\nApply\u00a0 IBM MQ Appliance cumulative security update 9.4.5.3 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 10 LTS\nApply IBM MQ Appliance fix pack 10.0.0.5 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.", "supportingMedia": [{"type": "text/html", "value": "<p>This vulnerability is addressed under APAR DT472411</p><p>IBM strongly recommends addressing the vulnerability now.</p><p><strong>IBM MQ Appliance version 9.4 LTS</strong><br/>Apply <a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=9.4.0.26-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance fix pack 9.4.0.26</a>, or later firmware.</p><p><strong>IBM MQ Appliance version 9.4 CD - M2003</strong><br/>Upgrade to <a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=10.0.0.5-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance 10.0.0.5</a>, or later firmware.</p><p><strong>IBM MQ Appliance version 9.4 CD - M2002</strong><br/>Apply\u00a0<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=9.4.5.3-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance cumulative security update 9.4.5.3</a>, or later firmware.</p><p><strong>IBM MQ Appliance version 10 LTS</strong><br/>Apply <a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/WebSphere/IBM+MQ+Appliance+M2000&function=fixId&fixids=10.0.0.5-IBM-MQ-Appliance+&includeSupersedes=1\" rel=\"nofollow\">IBM MQ Appliance fix pack 10.0.0.5</a>, or later firmware.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7284690", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-18T15:55:43.394Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10747", "state": "PUBLISHED", "dateUpdated": "2026-09-21T12:47:23.571Z", "dateReserved": "2026-06-03T13:39:03.419Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-09-18T15:55:43.394Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}