Security Advisory

IBM Product Security Update Advisory

  • Nov 11 2026
IBM Product Security Update Advisory

Overview

A security update has been released to address vulnerabilities discovered in IBM products. The affected products are IBM MQ, IBM API Connect, and IBM Aspera Faspex; users of these products should update to the latest version.

Affected Vulnerabilities

  • CVE-2026-11724: An after-authentication arbitrary code execution vulnerability in the Managed File Transfer component of IBM MQ. – CVE-2026-16720: A vulnerability that bypasses authentication in IBM API Connect.
  • CVE-2026-17399: A post-authentication arbitrary code execution vulnerability in IBM API Connect. – CVE-2026-123218: A privilege escalation vulnerability in IBM Aspera Faspex caused by authorization bypass.

Affected Versions

  • IBM MQ 9.2 LTS: 9.2.0.0 or later, up to and including 9.2.0.44. – IBM MQ 9.3 LTS: 9.3.0.0 or later, up to and including 9.3.0.42.
  • IBM MQ 9.4 LTS: 9.4.0.0 or later, but no later than 9.4.0.26.
  • IBM MQ 9.4 CD: 9.4.0.0 or later, up to and including 9.4.5.1. – IBM MQ 10.0 LTS: 10.0.0.0 or later, up to and including 10.0.0.5.
  • IBM MQ 10.0 CD: 10.0.0.0 or higher, 10.0.0.5 or lower. – IBM API Connect 10.0.8.0 or higher, 10.0.8.12 or lower.
  • IBM API Connect 12.1.0.0 or later, but no later than 12.1.1.2. – IBM Aspera Faspex 5.0.0 or later, but no later than 5.0.19.

Revised Version

  • CVE-2026-11724 affects IBM MQ 9.2 LTS 9.2.0.46 and later, IBM MQ 9.3 LTS 9.3.0.43 or later, IBM MQ 9.4 LTS 9.4.0.30 or later, IBM MQ 9.4 CD 10.0.1.0 or later, IBM MQ 10.0 LTS 10.0.0.6 or later, and IBM MQ 10.0 CD 10.0.1.0 or later.
  • CVE-2026-16720 and CVE-2026-17399 have been resolved in IBM API Connect 10.0.8.13 or later and IBM API Connect 12.1.1.3 or later.
  • CVE-2026-123218 has been resolved in IBM Aspera Faspex 5.0.19 PL1.

Tags:
Previous Post

Next Post