IBM MQ 9.2 to 10.0 consumers built with the XMS .NET client are susceptible to insecure deserialization of ObjectMessage payloads. A malicious actor who can authenticate to a consumer application can craft a payload that is deserialized, causing the application to execute code of the attacker’s choosing. This flaw aligns with CWE-502 and can lead to full compromise of the system running the consumer API, resulting in loss of confidentiality, integrity, and availability.

Affected products are IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD. These versions were released as long‑term support or current development builds and are listed in the vendor’s known issue list.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must be able to authenticate to a consumer application; no public exploits have been documented yet. The exploitation path involves sending a specially crafted ObjectMessage that triggers deserialization. Given the severity, the risk is high for environments where the XMS .NET client is in use and the vulnerability remains unpatched.