{"id":"CVE-2026-10859","aliases":["EUVD-2026-117076","GHSA-6fmg-55h8-722v"],"status":"published","title":"IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00355,"percentile":0.29481,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-11-04T20:26:15Z","modified":"2026-11-09T16:54:22Z","products":[{"vendor":"ibm","product":"mq"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7294664","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10859"},{"url":"https://github.com/advisories/GHSA-6fmg-55h8-722v"}],"sources":{"cve":[{"id":"CVE-2026-10859","title":"IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.","status":"published","published":"2026-11-04T20:26:15.673Z","modified":"2026-11-11T11:30:19.455Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-09T17:34:05.130069Z"}],"euvd":[{"id":"EUVD-2026-117076","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.","status":"published","published":"2026-11-04T20:26:15Z","modified":"2026-11-11T11:30:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T18:17:40.212453Z"}],"ghsa":[{"id":"GHSA-6fmg-55h8-722v","title":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS,...","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.","status":"published","published":"2026-11-04T21:32:30Z","modified":"2026-11-09T18:31:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-09T18:49:19.883486Z"}],"nvd":[{"id":"CVE-2026-10859","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.","status":"published","published":"2026-11-04T21:17:48.103Z","modified":"2026-11-09T17:17:08.213Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-09T20:15:34.048597Z"}]}}