PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8915 IBM CVE debrief

CVE-2016-8915 is an IBM WebSphere MQ 8.0 availability issue in which an authenticated user with access to the queue manager and queue may be able to deny service to other channels running under the same process. NVD maps the issue to CWE-284 and rates it CVSS 3.0 6.5 (medium), reflecting network reachability, low complexity, and required privileges with a high availability impact. NVD also lists affected IBM WebSphere MQ 8.0 CPEs through 8.0.0.5.

Vendor
IBM
Product
Websphere Mq
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

IBM MQ administrators, middleware/platform owners, and security teams responsible for queue managers, queues, and channel isolation in IBM WebSphere MQ 8.0 environments.

Technical summary

The vulnerable condition is access-control related: an authenticated user with the right queue manager and queue access can interfere with other channels sharing the same process. NVD classifies the weakness as CWE-284 (Improper Access Control) and the CVSS vector indicates no confidentiality or integrity impact, but high availability impact.

Defensive priority

Medium priority. Treat as a patch-and-permissions issue: confirm whether any IBM WebSphere MQ 8.0 deployments are in scope, then apply IBM's corrective guidance and review queue/queue-manager access controls.

Recommended defensive actions

  • Review IBM PSIRT advisory reference 1998649 and the matching IBM remediation guidance for affected WebSphere MQ 8.0 systems.
  • Apply IBM-provided fixes or updates to affected WebSphere MQ 8.0 deployments as soon as feasible.
  • Audit authenticated user permissions on queue managers and queues to ensure access is limited to intended operators and applications.
  • Monitor MQ channel behavior for unexpected interruptions in shared-process configurations.

Evidence notes

This debrief is based on the NVD CVE record and the IBM PSIRT reference cited there. The source corpus states that IBM WebSphere MQ 8.0 is affected, with NVD listing vulnerable CPE entries from 8.0 through 8.0.0.5, and provides the CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H plus CWE-284.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8915 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8915

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8915 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8915

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.