PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8915 IBM CVE debrief

CVE-2016-8915 is an IBM WebSphere MQ 8.0 availability issue in which an authenticated user with access to the queue manager and queue may be able to deny service to other channels running under the same process. NVD maps the issue to CWE-284 and rates it CVSS 3.0 6.5 (medium), reflecting network reachability, low complexity, and required privileges with a high availability impact. NVD also lists affected IBM WebSphere MQ 8.0 CPEs through 8.0.0.5.

Vendor
IBM
Product
CVE-2016-8915
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

IBM MQ administrators, middleware/platform owners, and security teams responsible for queue managers, queues, and channel isolation in IBM WebSphere MQ 8.0 environments.

Technical summary

The vulnerable condition is access-control related: an authenticated user with the right queue manager and queue access can interfere with other channels sharing the same process. NVD classifies the weakness as CWE-284 (Improper Access Control) and the CVSS vector indicates no confidentiality or integrity impact, but high availability impact.

Defensive priority

Medium priority. Treat as a patch-and-permissions issue: confirm whether any IBM WebSphere MQ 8.0 deployments are in scope, then apply IBM's corrective guidance and review queue/queue-manager access controls.

Recommended defensive actions

  • Review IBM PSIRT advisory reference 1998649 and the matching IBM remediation guidance for affected WebSphere MQ 8.0 systems.
  • Apply IBM-provided fixes or updates to affected WebSphere MQ 8.0 deployments as soon as feasible.
  • Audit authenticated user permissions on queue managers and queues to ensure access is limited to intended operators and applications.
  • Monitor MQ channel behavior for unexpected interruptions in shared-process configurations.

Evidence notes

This debrief is based on the NVD CVE record and the IBM PSIRT reference cited there. The source corpus states that IBM WebSphere MQ 8.0 is affected, with NVD listing vulnerable CPE entries from 8.0 through 8.0.0.5, and provides the CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H plus CWE-284.

Official resources

CVE published by NVD on 2017-02-22 and later modified on 2026-05-13. This debrief uses the published date for timing context.