[NEU] [hoch] IBM MQ: Mehrere Schwachstellen

highCVE-2026-11375 CVE-2026-11378 CVE-2026-11381 CVE-2026-11726 CVE-2026-13265 CVE-2026-13275

Ein Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-09-15
Exploitation: Not in CISA KEV at last sync

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3365

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-132650.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-132750.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-132850.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-132870.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-132930.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-11375	coverage & exploitation status	NVD · CVE.org
CVE-2026-11378	coverage & exploitation status	NVD · CVE.org
CVE-2026-11381	coverage & exploitation status	NVD · CVE.org
CVE-2026-11726	coverage & exploitation status	NVD · CVE.org
CVE-2026-13265	coverage & exploitation status	NVD · CVE.org
CVE-2026-13275	coverage & exploitation status	NVD · CVE.org
CVE-2026-13285	coverage & exploitation status	NVD · CVE.org
CVE-2026-13287	coverage & exploitation status	NVD · CVE.org
CVE-2026-13293	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for IBM MQ

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-13265: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LT…nvd · 2026-09-14
highCVE-2026-13293: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LT…nvd · 2026-09-14
highCVE-2026-13287: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LT…nvd · 2026-09-14
highCVE-2026-13285: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LT…nvd · 2026-09-14
highCVE-2026-13275: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LT…nvd · 2026-09-14
high[NEU] [hoch] IBM MQ Appliance (Axios Node.js): Mehrere Schwachstellencert-bund · 2026-09-11