External risk intelligence

IBM MQ Unsafe JNDI Lookup Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-12351

The vulnerability involves the IVT (Installation Verification Tool) application within IBM MQ. While IBM MQ itself is often used in back-end infrastructure, the IVT is typically a diagnostic or configuration utility. It is not designed to be exposed to the public internet, though it could be reachable if an administrator improperly deploys or exposes it in certain environments.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in IBM MQ software that could allow an attacker to execute code remotely by exploiting how the system processes certain lookups within its IVT application. This could potentially impact the confidentiality, integrity, and availability of systems running the affected software.

Remote code execution flaw in IBM MQ software.
Matters if IBM MQ is critical to your operations.
Confirm if your IBM MQ is affected and address it.

Attack Path

How an attacker could exploit the issue

An attacker can reach and trigger this vulnerability by sending specially crafted data to an IBM MQ instance, specifically when the IVT application is deployed. This occurs due to how the system processes JNDI lookups, which, when mishandled, can allow an attacker to execute arbitrary code.

No privileges required for entry.
Unsafe JNDI lookup processing triggers vulnerability.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability, when supported by the advisory, could allow a remote attacker to execute arbitrary code by exploiting unsafe JNDI lookup processing within the IVT application.

System code execution.
Unsafe JNDI lookup processing.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability in IBM MQ, the Platform Engineering or Infrastructure teams are likely responsible for the underlying MQ installation, while Application Owners would manage the IVT application if it's deployed. The initial practical step is to identify all instances of the affected IBM MQ versions, determine their exposure and business criticality, and then pinpoint the accountable owner to plan remediation, prioritizing systems that are externally reachable or handle sensitive data.

Platform/Infrastructure owns the issue.
Verify IVT deployment and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM MQ and why is it used?

IBM MQ is robust middleware software designed for messaging. It allows different applications, systems, and services to communicate by reliably sending and receiving data between them, ensuring that messages are not lost even if parts of the network are temporarily unavailable.

What does CVE-2026-12351 mean for software security?

This vulnerability is classified as Improper Neutralization of Special Elements (CWE-74). It means the software fails to properly sanitize input before using it in a JNDI lookup, a process for naming and directory services. This flaw can allow an attacker to trick the system into running unauthorized code.

How is this vulnerability triggered?

An attacker triggers this by sending malicious data to an IBM MQ instance where the Installation Verification Tool (IVT) is currently deployed. If the IVT is not deployed or installed on the system, the specific code path that leads to this unsafe lookup process is not active.

Do I need to worry if my IBM MQ instance is internal?

According to Halo Surface Signal, this vulnerability is most relevant to systems exposed to the internet. While internal instances are theoretically safer, any IBM MQ server with the IVT application running remains a potential target if an attacker gains access to your internal network.

What are the first steps to address this CVE?

Start by identifying all IBM MQ instances in your environment to see which ones have the IVT application deployed. Once you have an inventory, coordinate with your infrastructure and application teams to verify the necessity of the IVT and plan for updates to secure the affected versions.

References

www.ibm.com/support/pages/node/7284541

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.