CVE-2026-12155: CWE-502 Deserialization of untrusted data in IBM MQ Operator

IBM MQ Operator contains a deserialization vulnerability (CWE-502) that allows an authenticated attacker to cause a denial of service condition. This is achieved by sending specially crafted multicast status messages that trigger a NULL pointer dereference, leading to service disruption. The vulnerability affects a broad range of IBM MQ Operator versions, including multiple minor and patch releases across several major versions. The CVSS v3.1 base score is 6.5, indicating a medium severity impact with network attack vector, low attack complexity, and requiring privileges but no user interaction. The impact is limited to availability with no confidentiality or integrity impact.

The vulnerability allows an authenticated attacker to cause a denial of service by triggering a NULL pointer dereference via specially crafted multicast status messages. This results in service disruption of the IBM MQ Operator. There is no indication of confidentiality or integrity compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's official security advisories for updates. Until a fix is available, restrict access to the IBM MQ Operator to trusted authenticated users only to reduce risk.