IBM MQ Appliance contains an unauthenticated heap buffer overflow in protocol message processing that may cause denial of service or, potentially, arbitrary code execution. IBM scored it CVSS 10.0 CRITICAL.
What Is It
CVE-2026-10747 is a heap-based buffer overflow (CWE-122) in IBM MQ Appliance. According to IBM's advisory, the flaw sits in protocol message processing and is reachable before authentication, allowing a remote attacker to trigger a denial of service or potentially execute arbitrary code.
IBM PSIRT assigned a CVSS 3.1 base score of 10.0 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, exploitability 3.9, impact 6.0. The maximum score comes from the combination of network reach, low attack complexity, no privileges, no user interaction, and a changed scope, meaning successful exploitation can affect resources beyond the vulnerable component itself.
The CVE was published 2026-09-18 and is currently in NVD status Awaiting Analysis.
Why It Matters
Pre-authentication memory corruption carries unusual weight on a message-broker appliance. MQ Appliance sits in the middle of transaction and integration flows, so an attacker who reaches the listening protocol port needs no credentials and no user to click anything. The changed-scope rating indicates that the impact of a successful exploit may extend past the MQ process itself.
CVE-2026-10747 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing, so active exploitation is not confirmed. That is not a reason to defer patching a 10.0 pre-auth RCE candidate.
What's Vulnerable
IBM lists the following MQ Appliance version ranges as affected:
- 9.4 LTS: 9.4.0.0 through 9.4.0.25
- 9.4 CD: 9.4.1.0 through 9.4.5.2
- 10.0: 10.0.0.0 and 10.0.0.1
Affected CPEs cover ibm:mq_appliance at 9.4, 9.4.0, 9.4.0.0, 9.4.1.0, 10.0.0.0, and 10.0.0.1.
Patch Status
The only remediation reference carried in the NVD record is IBM's support bulletin (node 7284690). The NVD entry does not specify fixed version numbers or a workaround, and no CISA-mandated remediation deadline applies since the CVE is not listed in the KEV catalog. Administrators should consult the IBM advisory directly for the fix level applicable to their LTS or CD stream, and in the interim restrict network exposure of MQ Appliance protocol listeners to trusted segments.
Sources
- IBM Security Bulletin; https://www.ibm.com/support/pages/node/7284690
- NVD, CVE-2026-10747, https://nvd.nist.gov/vuln/detail/CVE-2026-10747