PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12155 IBM CVE debrief

IBM MQ Deserialization of Untrusted Data vulnerability allows an authenticated attacker to cause a denial of service via crafted multicast status messages triggering a NULL pointer dereference. Affected product deployments require review for potential exposure, and defenders should apply patches, restrict access, and monitor systems. The vulnerability affects multiple versions of IBM MQ and MQ Advanced container images, with a medium severity CVSS score of 6.5. Defenders should review and apply patches from IBM for affected versions, restrict access to multicast status messages, and monitor systems for unusual activity.

Vendor
IBM
Product
MQ Operator
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-19
Original CVE updated
2026-10-19
Advisory published
2026-10-19
Advisory updated
2026-10-19

Who should care

IBM MQ administrators and users, Security teams, IT teams, and operators of affected systems should review and apply patches, restrict access to multicast status messages, and monitor systems for unusual activity. Affected deployments require verification and potential updates to prevent exploitation. Vulnerability management and security teams should prioritize patching and verify system exposure. Platform and asset

Why it matters

CVE-2026-12155 is a medium-severity vulnerability in IBM MQ that could allow an authenticated attacker to cause a denial of service. Defenders should review and apply patches, restrict access to multicast status messages, and monitor systems for unusual activity. The vulnerability affects multiple versions of IBM MQ and MQ Advanced container images.

  • Denial of Service (DoS) via crafted multicast status messages
  • Potential disruption to business operations
  • Need for patching and version verification
  • Possible impact on system availability and reliability

Technical summary

The vulnerability in IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. The vulnerability affects multiple versions of IBM MQ and MQ Advanced container images. Defenders should review and apply patches from IBM for affected versions, restrict access to multicast status messages to only trusted sources, and monitor IBM MQ systems for unusual activity.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply patches from IBM for affected versions of IBM MQ
  • Restrict access to multicast status messages to only trusted sources
  • Monitor IBM MQ systems for unusual activity

Evidence notes

The CVE record and source item provide details on the vulnerability in IBM MQ. The vulnerability could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12155 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12155

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12155 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12155

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • IBM MQ Deserialization of Untrusted Data

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/12xxx/CVE-2026-12155.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://www.ibm.com/support/pages/node/7292667

    Supplemental source - vendor-advisory, patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.