IBM week 43 of 2026: MQ Operator and QRadar flaws lead 21 CVEs

The release at a glance

IBM published 21 CVEs for the week of 19–25 October 2026. Ten are rated high severity, nine medium and two low. None of these CVEs appears in CISA's Known Exploited Vulnerabilities catalogue, and none is reported as exploited. By product, MQ Operator accounts for 15 CVEs; Sterling Connect:Direct for Unix has two, and Verify Identity Access, QRadar Security Information and Event Management, QRadar and MQ each have one. The issues that stand out are hard-coded credentials in the Verify Identity Access and Security Verify Access appliances, several buffer-overflow and deserialisation flaws in MQ, and two pre-authentication QRadar SIEM weaknesses.

What matters most

Verify Identity Access and Security Verify Access. CVE-2026-109126 (CVSS 8.8) is a hard-coded credentials flaw affecting Verify Identity Access 11.0.3.1 and Security Verify Access 10.0.9.3. A physically proximate attacker could gain elevated privileges; IBM states a fix is available, though no fixed version is listed.

MQ Operator and MQ Advanced container images. CVE-2026-10574 (8.8) and CVE-2026-10572 (8.8) are heap buffer overflows triggered by malformed MQPUT or MQPUT1 operations and message options. CVE-2026-10743 (8.8) arises from improper validation of buffer sizes in MQOPEN operations. CVE-2026-12665 (8.1) is a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment; it is remotely reachable without authentication but has high attack complexity. These four are fixed in MQ Operator 3.4.0.

QRadar SIEM and QRadar. CVE-2026-93441 (8.6) is a pre-authentication denial-of-service flaw caused by uncontrolled resource consumption in the HTTP receiver. CVE-2026-93442 (8.2) is an out-of-bounds read that can cause denial of service or information disclosure, also remotely exploitable without authentication. IBM states fixes are available.

Sterling Connect:Direct for Unix. CVE-2026-105453 (8.4) is an improper privilege management issue allowing a local attacker to gain elevated privileges. Affected versions are 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6.

Patch in this order

1. Patch QRadar SIEM and QRadar first. CVE-2026-93441 and CVE-2026-93442 are both remotely exploitable without authentication and can cause denial of service; CVE-2026-93442 can also disclose information. Apply IBM's fixes to the affected releases.
2. Update MQ Operator to 3.4.0. This resolves CVE-2026-12665, the pre-authentication TLS stack buffer overflow, as well as CVE-2026-10574, CVE-2026-10572, CVE-2026-10743, CVE-2026-12148 and CVE-2026-12350. Follow IBM's guidance for MQ Advanced container images. For the separate MQ denial-of-service flaw CVE-2026-14511 affecting MQ 9.4.5.0 through 9.4.5.1, apply IBM's fix.
3. Update Verify Identity Access and Security Verify Access for CVE-2026-109126. IBM states a fix is available; the advisory does not list a fixed version. Prioritise appliances that are physically adjacent to untrusted users.
4. Patch Sterling Connect:Direct for Unix for CVE-2026-105453 and CVE-2026-93888. IBM states fixes are available for the affected 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 versions.
5. Then work through the remaining medium and low MQ Operator CVEs in line with IBM's advisory.

Beyond the patch

An IBM week dominated by MQ Operator is easier to manage when internet-facing QRadar and MQ services are already in the asset inventory. Virtual CISO Services (vCISO) helps catch unauthenticated, network-reachable services such as QRadar's HTTP receiver before an advisory forces a scramble. For the MQ buffer-overflow and deserialisation flaws, Implementation & Assessment Services can validate the update and harden message-handling paths through penetration testing and hardening.