IBM MQ Appliance could

CVE-2026-10747 is a heap-based buffer overflow (CWE-122) in the protocol message processing layer of IBM MQ Appliance. The flaw triggers *before authentication*, meaning any network-adjacent attacker — or any insider — who can reach the MQ listener port (typically TCP/1414) can send a crafted message that overflows a heap buffer, potentially achieving arbitrary code execution or, at minimum, crashing the appliance. Affected versions span IBM MQ Appliance 9.4 LTS (9.4.0.0 – 9.4.0.25), 9.4 CD (9.4.1.0 – 9.4.5.2), and 10.0 LTS (10.0.0.0 – 10.0.0.1). Patches are available in 9.4.0.26, 9.4.5.3, and 10.0.0.5.

IBM's vendor CVSS of 10.0 with S:C is aggressive but defensible on paper: the attack is pre-auth, low-complexity, requires zero user interaction, and compromising the appliance lets an attacker tamper with every message flowing through it — affecting downstream systems beyond the appliance's own security boundary. In practice, noisgate shaves this to 9.6 because MQ Appliance port 1414 is virtually never internet-facing (it lives deep inside the data center), no public proof-of-concept exists yet, and EPSS places exploitation probability at only 0.52% in the next 30 days. That said, the floor stays CRITICAL: IBM MQ Appliance is, by definition, a high-value production middleware component in nearly 100% of its deployments. Pre-auth RCE on the message backbone is a domain-takeover-equivalent event for business-critical data flows.

1. Apply vendor patches immediately — Upgrade to 9.4.0.26 (LTS), 9.4.5.3 (CD), or 10.0.0.5 within the noisgate CRITICAL mitigation SLA of 3 days. IBM states no workaround exists — patching is the only remediation. Schedule emergency maintenance windows for MQ Appliance firmware updates.
2. Restrict port 1414 access to authorized source IPs only — Implement firewall rules / ACLs that permit TCP/1414 connections only from known application server IPs. This is the single most effective compensating control until patching is complete. Deploy within hours if the patch cannot be applied in 3 days.
3. Enable MQ channel authentication records (CHLAUTH) — Configure CHLAUTH rules to reject connections from unauthorized IP addresses and user IDs at the MQ layer. While the vulnerability is pre-auth (it fires before CHLAUTH processing), defense-in-depth still matters for reducing overall attack surface.
4. Monitor MQ Appliance logs and network traffic — Configure SIEM alerting on MQ Appliance error logs (AMQ errors, core dumps, unexpected restarts). Set up network flow monitoring for anomalous connections to port 1414 from non-application sources. Deploy within 24 hours.
5. Segment the MQ Appliance VLAN — Place MQ Appliances in a dedicated network segment with strict ingress/egress rules. Block all outbound internet access from the appliance to limit post-exploitation data exfiltration and C2 communication.

Run this script on the MQ Appliance itself via SSH, or on a management workstation with SSH access. Invoke with: bash check_cve_2026_10747.sh <appliance_hostname_or_ip>. Requires SSH access with an admin-level account on the appliance, or run locally on the appliance shell.

#!/bin/bash
# check_cve_2026_10747.sh — CVE-2026-10747 IBM MQ Appliance heap overflow checker
# Usage: bash check_cve_2026_10747.sh [appliance_host]
# If no host given, checks local appliance.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

HOST="${1:-localhost}"

get_version() {
  if [ "$HOST" = "localhost" ] || [ "$HOST" = "$(hostname)" ]; then
    dspmqver 2>/dev/null | grep -i 'version' | head -1 | awk '{print $NF}'
  else
    ssh "$HOST" 'dspmqver 2>/dev/null' | grep -i 'version' | head -1 | awk '{print $NF}'
  fi
}

VERSION=$(get_version 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine IBM MQ Appliance version on $HOST"
  exit 2
fi

echo "Detected IBM MQ Appliance version: $VERSION"

# Parse major.minor.mod.fix
IFS='.' read -r MAJ MIN MOD FIX <<< "$VERSION"

# Fixed versions:
#   9.4 LTS: 9.4.0.26+
#   9.4 CD:  9.4.5.3+
#   10.0 LTS: 10.0.0.5+

if [ "$MAJ" -eq 9 ] && [ "$MIN" -eq 4 ] && [ "$MOD" -eq 0 ]; then
  # 9.4 LTS stream
  if [ "$FIX" -ge 26 ]; then
    echo "PATCHED — $VERSION is 9.4 LTS at fix pack 26 or later (CVE-2026-10747 fixed in 9.4.0.26)"
    exit 0
  else
    echo "VULNERABLE — $VERSION is 9.4 LTS below fix pack 26 (need 9.4.0.26+)"
    exit 1
  fi
elif [ "$MAJ" -eq 9 ] && [ "$MIN" -eq 4 ] && [ "$MOD" -ge 1 ]; then
  # 9.4 CD stream (9.4.1.x - 9.4.5.x)
  if [ "$MOD" -gt 5 ] || ([ "$MOD" -eq 5 ] && [ "$FIX" -ge 3 ]); then
    echo "PATCHED — $VERSION is 9.4 CD at 9.4.5.3 or later (CVE-2026-10747 fixed in 9.4.5.3)"
    exit 0
  else
    echo "VULNERABLE — $VERSION is 9.4 CD below 9.4.5.3 (need 9.4.5.3+)"
    exit 1
  fi
elif [ "$MAJ" -eq 10 ] && [ "$MIN" -eq 0 ] && [ "$MOD" -eq 0 ]; then
  # 10.0 LTS stream
  if [ "$FIX" -ge 5 ]; then
    echo "PATCHED — $VERSION is 10.0 LTS at fix pack 5 or later (CVE-2026-10747 fixed in 10.0.0.5)"
    exit 0
  else
    echo "VULNERABLE — $VERSION is 10.0 LTS below fix pack 5 (need 10.0.0.5+)"
    exit 1
  fi
else
  echo "UNKNOWN — $VERSION does not match known affected version ranges (9.4.x or 10.0.0.x)"
  exit 2
fi

1. SecurityOnline — Critical IBM MQ Vulnerabilities CVE-2026-10747
2. OffSeq Threat Radar — CVE-2026-10747 Live Threat Intelligence
3. Shenlong CVE Platform — IBM MQ Appliance Heap Overflow Intel
4. Strix AI — CVE-2026-10747 Analysis
5. ThreatInt — CVE-2026-10747 Record
6. Vulners — CVE-2026-10747
7. HackTricks — 1414 Pentesting IBM MQ
8. Enlyft — IBM WebSphere MQ Market Share