IBM MQ contains a vulnerability identified as CVE-2026-10853 (CWE-470: Use of Externally-Controlled Input to Select Classes or Code, also known as 'Unsafe Reflection'). This flaw allows an authenticated attacker with cluster access to exploit improper validation of cluster command message lengths. Exploitation could lead to denial of service or potentially arbitrary code execution. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with attack vector network, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with authenticated cluster access can exploit this vulnerability to cause denial of service or potentially execute arbitrary code on affected IBM MQ systems. This could compromise system availability and security, impacting confidentiality and integrity of the messaging environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict cluster access to trusted users and monitor for unusual activity related to cluster command messages.