PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3013 IBM CVE debrief

CVE-2016-3013 is an IBM WebSphere MQ 8.0 availability issue where an authenticated user could crash an MQ channel due to improper data conversion handling. NVD rates the issue medium severity and lists affected versions up to 8.0.0.5. IBM’s advisory reference is available, and the record does not indicate known ransomware use or KEV inclusion.

Vendor
IBM
Product
Websphere Mq
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

IBM WebSphere MQ administrators, middleware and platform teams, and security teams responsible for authenticated MQ access paths should care most, especially in environments running WebSphere MQ 8.0 or older maintenance levels.

Technical summary

NVD describes the flaw as improper data conversion handling in IBM WebSphere MQ 8.0 that can allow an authenticated user to crash an MQ channel. The NVD record lists the vulnerable CPE range as IBM WebSphere MQ versions through 8.0.0.5 and assigns CVSS 3.0 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a network-reachable availability impact with required authentication and no direct confidentiality or integrity impact in the published vector.

Defensive priority

Medium priority; remediate promptly in environments where authenticated users can reach MQ channels, and prioritize faster action if service availability is business-critical.

Recommended defensive actions

  • Review IBM Reference 1998661 and apply the vendor-recommended fix or upgrade path for the affected MQ release line.
  • Confirm whether any IBM WebSphere MQ 8.0 deployments are at or below version 8.0.0.5 and schedule remediation.
  • Restrict authenticated user access to MQ channels and enforce least-privilege permissions for MQ administration and messaging roles.
  • Monitor for unexpected MQ channel crashes, restart loops, and related availability events in logs and operational monitoring.
  • Validate that incident response and service recovery procedures for MQ channel outages are current and tested.

Evidence notes

This debrief is based on the supplied NVD record and IBM vendor reference. The NVD entry was published on 2017-02-22 and later modified on 2026-05-13. NVD states the flaw affects IBM WebSphere MQ versions through 8.0.0.5 and classifies the weakness as CWE-19. The vendor reference points to IBM support documentation for the issue, and the record includes no KEV or ransomware indicators in the provided corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-3013 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-3013

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-3013 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-3013

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.