## Summary
IBM MQ Java client library contains an unsafe deserialization issue that can enable JNDI injection. An authenticated attacker may be able to execute arbitrary code in client applications.
## Technical Details
- Vulnerability type: unsafe deserialization of untrusted data leading to JNDI injection.
- CWE: CWE-502.
- CVE: CVE-2026-11729.
- Affected component (installable MQ component): Java messaging.
- Preconditions: attacker must be authenticated (per IBM bulletin / NVD description).
- Attack surface: NETWORK (per provided CVSS vector).
- IBM bulletin states the issue is in the IBM MQ Java client's internal command manager.
## Affected
- IBM MQ 9.1.0.0 through 9.1.0.37 (LTS)
- IBM MQ 9.2.0.0 through 9.2.0.43 (LTS)
- IBM MQ 9.3.0.0 through 9.3.0.41 (LTS)
- IBM MQ 9.3.0.0 through 9.3.5.1 (CD)
- IBM MQ 9.4.0.0 through 9.4.0.25 (LTS)
- IBM MQ 9.4.0.0 through 9.4.5.1 (CD)
- IBM MQ 10.0.0.0
## Impact
- Arbitrary code execution in client applications via unsafe deserialization and JNDI injection.
- CVSS (provided): 8.5 with PR:L and AC:H.
## Mitigation
1. Apply the IBM-provided remediation/fixes referenced in the IBM security bulletin for CVE-2026-11729.
2. Ensure the affected installable component Java messaging is included in your patch/upgrade validation.
3. Note: IBM bulletin lists None for workarounds and mitigations, so rely on the remediation/fixes.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-502