CVE-2026-12148

7.5High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-502

Impact

Authenticated attackers with network access can execute arbitrary code or crash the service. They must hold valid credentials to interact with the MQ Classes for Java.

Root cause

The application performs unsafe deserialization of untrusted user input within MQ Classes for Java.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade IBM MQ Operator and its bundled MQ Classes for Java to the patched release referenced in the IBM security bulletin; no interim mitigation is specified.

shell

$ oc get csv -n openshift-operators | grep ibm-mq

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.

References

https://www.ibm.com/support/pages/node/7292667

Source: nvd.nist.gov/vuln/detail/CVE-2026-12148