Back Sploitus

CVE-2026

Sploitus • October 19, 2026

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk CVE-2026-10572 Discovered in IBM MQ A new vulnerability, CVE-2026-10572, has been identified in IBM MQ, allowing authenticated attackers to potentially execute arbitrary code or cause a denial of service via a heap buffer overflow during MQPUT operations with malformed message options. This flaw is classified as high severity with a CVSS score of 8.8. Affected systems include containerized queue managers and clusters managed by an operator, especially those exposed to untrusted networks. Attackers need network access and a low-privilege authenticated account to exploit this vulnerability. While the risk is significant, there is currently no evidence of active exploitation or a proof of concept available. IBM has released fixed versions, and users are advised to upgrade their systems promptly. Until patched, restricting network access to trusted clients is recommended. 2 sources 63

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)