Back Sploitus

CVE-2026

Sploitus • October 19, 2026

IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-12665: IBM MQ Vulnerability Allows Remote Code Execution IBM MQ has a vulnerability (CVE-2026-12665) that could enable remote attackers to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. This flaw affects queue managers, particularly those exposed to the internet or partner networks, and could compromise the confidentiality, integrity, and availability of business messaging. Successful exploitation may disrupt transaction flows, alter queued data, or provide attackers with a foothold in the MQ host. The CVSS score for this vulnerability is 8.1, indicating a high severity. Currently, there are no confirmed reports of active exploitation or proof-of-concept code available. IBM has not yet released specific indicators of compromise (IOCs) or exploitation activity. Organizations are advised to prioritize remediation by upgrading to fixed releases and restricting channel exposure. 2 sources 65

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)