IBM week 38, September 2026: MQ and Verify Access flaws lead 74 CVEs

The release at a glance

IBM’s week 38 advisory set, published between 14 and 20 September 2026, covers 74 CVEs. The severity distribution is 6 critical, 33 high, 32 medium and 3 low. No CVE in this release is marked as exploited, and none appears in CISA KEV. The most urgent items cluster in the IBM MQ family, Verify Identity Access and Sterling File Gateway. One pre-authentication heap buffer overflow in IBM MQ Appliance is rated CVSS 10.0. Other critical issues include unauthenticated remote code execution in IBM MQ, a buffer overflow in Verify Identity Access, an authentication bypass in Sterling File Gateway, and a critical heap underflow in MQ for HPE NonStop. IBM has published fixes for the most important CVEs.

What matters most

First look at these CVEs.

IBM MQ Appliance: CVE-2026-10747 is a heap buffer overflow in protocol message processing before authentication. A remote attacker could cause a denial of service or potentially execute arbitrary code. CVSS 3.1 base score is 10.0, critical.

IBM MQ: CVE-2026-12351 is unauthenticated remote code execution via unsafe JNDI lookup processing when the IVT application is deployed (CVSS 9.8). CVE-2026-11725 is an integer overflow in MQINQ request processing; an authenticated attacker could cause denial of service or potentially execute arbitrary code (CVSS 8.8). CVE-2026-12728 is a Java messaging deserialisation flaw that an authenticated attacker could use for arbitrary code execution (CVSS 8.8).

IBM MQ for HPE NonStop: CVE-2026-10858 is a heap buffer underflow when processing multi-segment messages. An authenticated attacker could cause denial of service or potentially execute code (CVSS 9.9).

Verify Identity Access / Security Verify Access: CVE-2026-11928 is a buffer overflow reachable over the network without authentication (CVSS 9.8). CVE-2026-11921 affects containers that may not apply management password change operations correctly (CVSS 9.1).

Sterling File Gateway: CVE-2026-75878 is an authentication bypass through an unvalidated SSO header; a remote attacker could obtain a fully authenticated session (CVSS 9.1).

Patch in this order

Patch in this order:

1. IBM MQ Appliance — CVE-2026-10747. This pre-authentication heap buffer overflow is rated CVSS 10.0. Treat any MQ Appliance reachable over the network, especially internet-facing ones, as the first action.
2. IBM MQ — CVE-2026-12351. Unauthenticated remote code execution through unsafe JNDI lookup applies when the IVT application is deployed. Confirm whether IVT is present and patch those systems before other MQ items.
3. Sterling File Gateway — CVE-2026-75878. Authentication bypass via an unvalidated SSO header can give a remote attacker a fully authenticated session. Patch internet-facing file transfer gateways promptly.
4. Verify Identity Access / Security Verify Access — CVE-2026-11928 and CVE-2026-11921. The buffer overflow is reachable without authentication, and container deployments may not apply password changes correctly. Address identity infrastructure early.
5. IBM MQ for HPE NonStop — CVE-2026-10858, and IBM MQ CVE-2026-11725, CVE-2026-10575, CVE-2026-11375, CVE-2026-11378, CVE-2026-11381, CVE-2026-12728. These authenticated high-severity issues can lead to denial of service or code execution. Move through them after pre-authentication issues.
6. Remaining high, medium and low CVEs across MQ, Verify Identity Access, Db2, WebSphere Application Server, QRadar, Sterling B2B Integrator, Secure Proxy and CICS TX Advanced. Apply through normal change management.

Beyond the patch

Next month, make IBM weeks a review of queue managers and identity infrastructure: identify which MQ Appliance, MQ, Verify Identity Access and Sterling File Gateway instances are reachable and whether IVT is deployed before the patch window. Virtual CISO Services (vCISO) can help map that exposure and prioritise network-reachable, pre-authentication issues, while Managed Detection & Response (MDR) can watch for code execution, privilege escalation or credential abuse that follows a successful exploit.