IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a vulnerability (CWE-913) due to improper control of dynamically-managed code resources. Specifically, the Resource Adapter Installation Verification Test application does not properly validate JNDI names, which could be exploited by an authenticated attacker with low privileges to execute arbitrary code on the application server. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An authenticated attacker with low privileges can exploit this vulnerability to execute arbitrary code on the IBM MQ application server. This can lead to full compromise of the affected server, impacting confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict access to the Resource Adapter Installation Verification Test application and limit authenticated user privileges to reduce exposure.