CVE-2026-10027 is a heap out-of-bounds write in IBM MQ, triggered by malformed compressed data on channels that have compression enabled. NVD scores it 8.1, high severity. IBM says to apply the fix for your stream, such as 9.4.0.26 on the 9.4 LTS line.
What's affected
IBM's bulletin, first published on 14 September 2026, lists these affected versions of IBM MQ (server component):
- 9.1.0.0 to 9.1.0.37 LTS
- 9.2.0.0 to 9.2.0.43 LTS
- 9.3.0.0 to 9.3.0.41 LTS
- 9.3.0.0 to 9.3.5.1 CD
- 9.4.0.0 to 9.4.0.25 LTS
- 9.4.0.0 to 9.4.5.1 CD
- 10.0.0.0
The fixes, tracked under known issue DT472389:
- 9.1 LTS: cumulative security update 9.1.0.38.
- 9.2 LTS: cumulative security update 9.2.0.44.
- 9.3 LTS: cumulative security update 9.3.0.42.
- 9.4 LTS: cumulative security update 9.4.0.26.
- 9.3 CD, 9.4 CD and 10.0.0.0: upgrade to IBM MQ 10.0.0.5.
IBM lists no workarounds or mitigations. The score is CVSS 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, no login, high complexity. The bulletin title speaks of unauthenticated remote code execution. IBM does not report exploitation, and the CVE is not on the CISA KEV list.
How to check if you're exposed
Find the version first, on each queue manager host.
dspmqver
Compare the result with the list above, paying attention to which stream you are on: LTS or CD.
Then check whether any channel uses compression, because the flaw is in the handling of compressed data on those channels. The MQSC attribute for message compression on a channel is COMPMSG. In runmqsc for your queue manager:
DISPLAY CHANNEL(*) COMPMSG
A channel whose value is anything other than NONE is configured to compress. Confirm the exact attribute names and values for your version in the IBM MQ documentation, since I have not verified them against your release. IBM's description says channels configured with compression enabled, so a queue manager with no compressed channels has a smaller exposure, though IBM still lists it as affected.
Finally, ask who can reach the listener port. The bulletin says an unauthenticated attacker with network access to the listener port is the threat, so the firewall rules around your MQ listeners are part of the answer.
What to do now
- List every queue manager, including development and test, and record the version and stream of each.
- Apply the IBM fix for your stream: 9.1.0.38, 9.2.0.44, 9.3.0.42 or 9.4.0.26 for LTS, or 10.0.0.5 for 9.3 CD, 9.4 CD and 10.0.0.0.
- Restrict network access to MQ listener ports to the applications and queue managers that must connect. Do not expose them to the internet.
- Review channels that use compression. If compression is not needed for a channel, switching it off removes the affected code path, but IBM lists no official workaround, so patching still comes first.
- Watch queue manager error logs for channel failures and for unexpected restarts, and keep the logs from before the update.
Why it matters
The weakness is CWE-787, out-of-bounds write. IBM describes it as a heap out-of-bounds write in the queue manager's message decompression handling. When a channel is set to compress messages, the receiving side has to expand the data. If the code trusts what the compressed data says about its own size, malformed input can make it write past the end of a buffer.
Decompression is a classic source of memory bugs because it turns a small input into a large output, and the sizes come from the sender. Parsers and decompressors that run before authentication are among the highest value targets in any server, because they run for anyone who can connect.
The CVSS vector rates attack complexity as high, which usually means the attacker needs some luck or knowledge of the target, and it is the reason the score is 8.1 and not near 10. IBM's bulletin title still describes unauthenticated remote code execution, so the sensible reading is: the barrier is real, the payoff is large, and the fix is available.
Message brokers sit at the center of an estate. They carry payments, orders and events between systems, and many sites run them for years without a restart. A flaw that can reach the queue manager from the network deserves a quick rollout, and the staged approach of testing on non-production first fits well here because MQ upgrades are routine.
Try it yourself
This post has five different fixes for five release streams. This demo shows how Safeguard lines up the fix that applies to the version you actually run.
Click through it at your own pace, or open it full screen.
Quick check
Which fix applies to my IBM MQ version?
It depends on your stream. LTS users apply 9.1.0.38, 9.2.0.44, 9.3.0.42 or 9.4.0.26. Users of 9.3 CD, 9.4 CD or 10.0.0.0 upgrade to 10.0.0.5.
Is there a workaround?
IBM lists none. Limiting network access to the listener and turning off unneeded compression can reduce exposure, but they are not official mitigations.
Sources
Last reviewed: 19 October 2026.
