## Summary
IBM MQ contains a JNDI injection vulnerability in the Resource Adapter Installation Verification Test (IVT) application. An authenticated attacker who can place messages on the IVT queue may be able to execute arbitrary code on the hosting application server.
## Technical Details
- Root issue: improper validation of JNDI names in the Resource Adapter Installation Verification Test application.
- Vulnerability class: CWE-913 (Improper Control of Dynamically-Managed Code Resources).
- Attack vector (per bulletin): remote authenticated attacker with the ability to put messages on the IVT queue.
- Impact mechanism: crafted JNDI-related input can lead to arbitrary code execution on the application server hosting the affected component.
- CVSS (per bulletin): 7.5 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
## Affected
- IBM MQ versions:
- 9.1.0.0 to 9.1.0.37 (LTS)
- 9.2.0.0 to 9.2.0.43 (LTS)
- 9.3.0.0 to 9.3.0.41 (LTS)
- 9.3.0.0 to 9.3.5.1 (CD)
- 9.4.0.0 to 9.4.0.25 (LTS)
- 9.4.0.0 to 9.4.5.1 (CD)
- 10.0.0.0
- Affected installable component(s):
- Java messaging
## Impact
- Arbitrary code execution on the hosting application server.
- Confidentiality, integrity, and availability impact are all indicated as high in the provided CVSS metrics.
## Mitigation
1. Apply the IBM-provided remediation/fixes referenced in the IBM Security Bulletin for CVE-2026-12354.
2. Ensure the affected Java messaging component is updated/remediated for all installed IBM MQ versions listed above.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-913