IBM Patches Critical MQ and Langflow RCE Flaws
IBM fixed 12 vulnerabilities in MQ, MQ Appliance and Langflow OSS, including a CVSS 10.0 unauthenticated RCE and several CVSS 9.8 code-injection bugs.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 12 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory summarizing 12 vulnerabilities patched by IBM across IBM MQ, IBM MQ Appliance, and Langflow OSS. Four of these are rated critical and can be exploited remotely without authentication or user interaction. The most severe, CVE-2026-10747, is a heap-based buffer overflow in IBM MQ with a maximum CVSS score of 10.0, allowing arbitrary code execution. Three additional critical flaws in Langflow OSS (CVE-2026-79724, CVE-2026-85025, CVE-2026-81204) carry CVSS 9.8 scores and allow unauthenticated attackers to execute arbitrary code or OS commands via improper neutralization of special elements (OS command injection) and code injection weaknesses.
The remaining eight vulnerabilities, all scored 8.8, require authenticated access but still allow code or command execution, and involve missing or incorrect authorization checks in addition to injection flaws. IBM has released updates addressing all 12 issues; no evidence of active exploitation is noted in the advisory. Defenders running IBM MQ, MQ Appliance, or Langflow OSS should prioritize patching the critical unauthenticated flaws immediately, given the low complexity of exploitation and lack of authentication requirements, and review authorization configurations affected by the missing/incorrect authorization CVEs.
Mentioned in this report
Detection guidance
IBM MQ Process Spawning Unexpected Shell Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
IBM MQ service processes (amqmrmp.exe, runmqserver.exe) spawning cmd.exe or powershell.exe - exploitation of buffer overflow or injection flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IBM MQ Process Spawning Unexpected Shell Interpreter
description: Detects IBM MQ processes spawning command-line interpreters - indicative
of successful exploitation of CVE-2026-10747 (buffer overflow) or injection flaws
allowing arbitrary code execution.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \amqmrmp.exe
- \runmqserver.exe
- \amqcrsta.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
filter_legitimate_mq_admin:
CommandLine|contains:
- /c echo
- /c ver
- /c whoami
condition: selection and not filter_legitimate_mq_admin
falsepositives:
- Legitimate IBM MQ administrative scripts invoking cmd for diagnostics
- Monitoring or backup agents spawning shells from MQ processes
level: high
id: 7c197a5c-97ba-5e00-a5f1-5b661a2c7021
status: experimental
author: Vorant
Langflow Python Process Executing System Commands
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Langflow (python.exe or flask) spawning cmd.exe, powershell.exe, or bash - exploitation of OS command injection (CVE-2026-79724, CVE-2026-85025, CVE-2026-81204). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Langflow Python Process Executing System Commands
description: Detects Langflow application processes spawning command-line interpreters
- indicative of successful exploitation of OS command injection flaws (CVE-2026-79724,
CVE-2026-85025, CVE-2026-81204).
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \python.exe
- \pythonw.exe
ParentCommandLine|contains:
- langflow
- flask
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
condition: selection_parent and selection_child
falsepositives:
- Langflow plugin or extension invoking system utilities for legitimate data processing
- Development environments running Langflow with intentional shell spawning
level: high
id: ea89bb95-43fc-5cdf-b4a0-f44d3add2d42
status: experimental
author: Vorant
Unauthorized IBM MQ Network Service Access Followed by Code Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Network connection to IBM MQ ports (1414/tcp or 5672/tcp for AMQP) followed by child process creation in MQ service - exploitation of unauthenticated RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthorized IBM MQ Network Service Access Followed by Code Execution
description: Detects network connections to IBM MQ listener ports (default 1414, 5672)
combined with spawning of child processes - indicative of successful exploitation
of unauthenticated RCE flaws (CVE-2026-10747, Langflow CVEs).
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \amqmrmp.exe
- \runmqserver.exe
- \python.exe
CommandLine|contains:
- cmd
- powershell
- bash
- sh
ParentImage:
- C:\Program Files\IBM\MQ\bin\runmqserver.exe
- C:\Program Files\IBM\MQ\bin\amqmrmp.exe
filter_maintenance:
CommandLine|contains:
- msiexec
- uninstall
condition: selection and not filter_maintenance
falsepositives:
- Legitimate IBM MQ administration via remote shells
- Scheduled backup or maintenance tasks connecting to MQ
level: medium
id: 7d022406-c0d3-565f-8713-6e30c5779c54
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0392.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs