What is CVE-2026-12355?

CVE-2026-12355 is a high-severity vulnerability in IBM Mq, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.1/10. Published 2026-09-15.

How severe is CVE-2026-12355?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in IBM Mq

CVE-2026-12355

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ibm Mq — versions 10.0.0.0

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-12355?: CVE-2026-12355 is a high-severity vulnerability in IBM Mq, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.1/10. Published 2026-09-15.
How severe is CVE-2026-12355?: High severity. CVSS v3 base score is 8.1 out of 10.