CVE-2025-36041: medium-severity vulnerability in IBM MQ Operator
IBM MQ improper certificate validation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.4%
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
Affected products
IBM · MQ OperatorRelated CVEs — IBM MQ Operator
In the same product, most dangerous first.
CVE-2024-39742HIGHIBM MQ Container authentication bypassEPSS 0.8%CVE-2024-39743MEDIUMIBM MQ Container denial of serviceEPSS 0.6%CVE-2026-10572HIGHIBM MQ Buffer OverflowEPSS 0.4%CVE-2026-10574HIGHIBM MQ Buffer OverflowEPSS 0.4%CVE-2025-27365MEDIUMIBM MQ Operator denial of serviceEPSS 0.4%CVE-2026-12148HIGHIBM MQ Deserialization of Untrusted DataEPSS 0.4%