IBM vulnerabilities, week 43 2026: MQ Operator and QRadar flaws lead 21 CVEs

The release at a glance

IBM published 21 CVEs for week 43 of 2026, covering 19 to 25 October. The release is dominated by IBM MQ: 15 of the 21 CVEs affect MQ Operator, with the rest spread across Sterling Connect:Direct for Unix (2), Verify Identity Access (1), QRadar SIEM (1), QRadar (1) and IBM MQ (1). Severity breaks down as 10 high, 9 medium and 2 low.

No CVE in this release is listed in CISA KEV, and none is reported as exploited. The highest-priority issues are a stack buffer overflow in MQ TLS certificate handling that is reachable without credentials, several authenticated heap buffer overflows in MQ message processing, a hard-coded credential in Verify Identity Access appliances, and two remote-reachable QRadar flaws. IBM has published fixes; where a fixed version is stated, MQ Operator 3.4.0 is the one to move to.

What matters most

IBM MQ Operator. CVE-2026-12665 is a stack buffer overflow during TLS channel establishment when a certificate carries a malformed distinguished name. It is reachable over the network without credentials, though attack complexity is high, and can execute arbitrary code. CVE-2026-10574 and CVE-2026-10572 are heap buffer overflows triggered by authenticated MQPUT or MQPUT1 operations with malformed message handle properties or options; both can cause denial of service or code execution. Upgrade MQ Operator to 3.4.0. IBM's advisory lists affected MQ Advanced container image revisions too.

IBM Verify Identity Access / Security Verify Access. CVE-2026-109126 is a hard-coded credential in Verify Identity Access 11.0.3.1 and Security Verify Access 10.0.9.3 Appliance. A physically proximate attacker can gain elevated privileges. It scores 8.8.

QRadar SIEM and QRadar. CVE-2026-93441 allows a remote, unauthenticated attacker to cause denial of service through uncontrolled resource consumption. CVE-2026-93442 is an out-of-bounds read that can cause denial of service or information disclosure. Both are network-reachable and do not require authentication.

IBM Sterling Connect:Direct for Unix. CVE-2026-105453 allows a local attacker to gain elevated privileges through improper privilege management. CVE-2026-93888 is a code injection flaw in the apnotify utility due to insufficient input validation. Affected versions are 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6.

Patch in this order

1. Patch IBM MQ Operator to 3.4.0 first. This addresses CVE-2026-12665, the pre-authentication TLS stack overflow, and the MQPUT heap overflows CVE-2026-10574 and CVE-2026-10572. Update MQ Advanced container images according to IBM's advisory if you run them.
2. Apply IBM's fixes for QRadar SIEM and QRadar: CVE-2026-93441 and CVE-2026-93442 are remote and unauthenticated, so they should come ahead of local-only issues.
3. Remediate CVE-2026-109126 in Verify Identity Access and Security Verify Access appliances, particularly any device that is not in a controlled physical location.
4. Patch Sterling Connect:Direct for Unix for CVE-2026-105453 and CVE-2026-93888.
5. Update IBM MQ 9.4.5.0 through 9.4.5.1 for CVE-2026-14511, an authenticated denial-of-service flaw.
6. Work through the remaining MQ Operator and MQ advisories in line with their medium and low severity ratings.

Beyond the patch

For a release with no CISA KEV entries or reported exploitation, the challenge is working out which of these systems are exposed before an attacker does. Virtual CISO Services (vCISO) can help identify MQ, QRadar and identity appliances that are reachable without credentials; Implementation & Assessment Services can test for the injection, deserialisation and authentication weaknesses in this release; and Managed Detection & Response (MDR) can monitor for code execution, privilege escalation or queue-manager anomalies if a patch is delayed.