← Vulnerability feed

Vulnerability record · CVE-2020-4682 · published 28 January 2021

CVE-2020-4682: Ibm mq deserialization of untrusted data vulnerability

Ibm · Mq

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

9.8 CVSS 3.1 Critical EPSS 7.8% · top 5.5% CWE-502 · Deserialization of untrusted data
9.8CVSS 3.1 base score, v2 10.0
7.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://exchange.xforce.ibmcloud.com/vulnerabilities/186509 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6408626 PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/186509 VDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6408626 PatchVendor Advisory

Track CVE-2020-4682 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-0896Ibm websphere mq memory buffer overflow vulnerabilityBuffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code …EPSS 6.7%10.0CVE-2007-6044Ibm websphere mq vulnerabilityMultiple unspecified vulnerabilities in IBM WebSphere MQ 6.0 have unknown impact and remote attack vectors involving "memory corruption." NOTE: as of…EPSS 2.0%9.8CVE-2026-10027Ibm mq out-of-bounds write vulnerabilityIBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compre…EPSS 0.38%9.1CVE-2022-22489Ibm mq xml external entity (xxe) vulnerabilityIBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A rem…EPSS 1.7%8.8CVE-2026-10853Ibm mq vulnerabilityIBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper v…EPSS 0.37%8.8CVE-2026-11375Ibm mq heap-based buffer overflow vulnerabilityIBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when p…EPSS 0.35%8.8CVE-2026-11378Ibm mq integer overflow vulnerabilityIBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distrib…EPSS 0.34%8.8CVE-2026-10575Ibm mq heap-based buffer overflow vulnerabilityIBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when proce…EPSS 0.28%

Source: NIST National Vulnerability Database (record CVE-2020-4682), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.