Key points
- CVE-2026-10572 is rated high severity with a CVSS score of 8.8.
- The flaw affects IBM MQ Operator versions up to 3.2.29 and various container images.
- Attackers must be authenticated to trigger the heap buffer overflow vulnerability.
IBM MQ contains a heap buffer overflow vulnerability that allows authenticated attackers to cause denial of service or execute arbitrary code. This flaw, identified as CVE-2026-10572, occurs when the server processes MQPUT operations with malformed message options.
What happened
The National Vulnerability Database records CVE-2026-10572 as a high-severity issue with a CVSS score of 8.8. The weakness stems from a heap buffer overflow, classified under CWE-122, within the IBM MQ messaging middleware. When an authenticated attacker sends MQPUT operations containing malformed message options, the system fails to handle the input correctly. This processing error allows the attacker to corrupt memory, leading to a denial of service or potential remote code execution. The flaw exists in how the software parses specific message metadata during put operations.
Why it matters
This vulnerability impacts a wide range of IBM MQ deployments, including the IBM MQ Operator and numerous container images. Affected Operator versions include those up to 3.2.29, as well as versions before 3.4.0, 3.4.1, and 3.5.0. A large number of IBM MQ Advanced container images are also vulnerable, spanning versions from early 9.4.0 releases through 10.0.0.5. Long-term support versions, including 9.3.0.x and specific 9.4.0.x releases, are included in the affected list. The breadth of affected versions means many organisations may have exposed systems.
What happens next
Organisations should immediately inventory their IBM MQ infrastructure to identify affected versions. Teams must check whether any systems are running the vulnerable Operator or container images listed in the advisory. If affected systems are found, security teams should prepare to apply patches or updates as soon as they become available. Monitoring logs for unusual MQPUT activity or malformed message options can help detect exploitation attempts. Prioritise remediation for systems accessible to authenticated users with message-sending privileges.
Patch priority
Teams usually prioritise systems exposed to internal networks where authenticated users can send messages. Check whether your MQ instances accept input from applications or services that might be compromised. Roll out fixes in a staged manner, starting with non-production environments to verify stability. Back up configuration files and message queues before applying updates to prevent data loss. If no fix exists yet, restrict access to MQ management interfaces and monitor for abnormal resource usage or crash logs.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: IBM MQ
- Audit all IBM MQ Operator and container image versions against the affected list provided by the vendor.
- Verify that authentication controls are strictly enforced on all MQ endpoints to limit the attacker pool.
- Monitor system logs for failed MQPUT operations or unexpected process terminations that indicate exploitation.
- Isolate affected systems from untrusted networks if a patch is not immediately available for deployment.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which IBM MQ versions are affected by CVE-2026-10572?
IBM MQ Operator up to 3.2.29 and before 3.4.0, 3.4.1, 3.5.0, plus numerous Advanced container images from 9.4.0.0 to 10.0.0.5 and LTS versions.
Is authentication required to exploit this vulnerability?
Yes, the National Vulnerability Database states that an attacker must be authenticated to cause the denial of service or code execution.
What is the severity rating of this CVE?
The CVSS score is 8.8, which classifies the vulnerability as high severity according to the NVD record.
