IBM published a security bulletin describing how IBM MQ can be affected by a cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server Liberty—the Liberty runtime IBM MQ uses to provide the IBM MQ Console and the IBM MQ REST API.1

What’s the issue?

The vulnerability is tracked as CVE-2025-12635 and is described as improper validation of user-supplied input leading to an XSS condition. IBM notes it could be exploited via a specially crafted URL to redirect a user to a malicious site.21

IBM rates the issue as Medium severity with a CVSS v3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).13

Who is affected?

IBM lists IBM MQ LTS and Continuous Delivery (CD) release trains as affected across versions 9.1, 9.2, 9.3, and 9.4. The bulletin also explicitly calls out that the affected installable component is “REST API and Console,” so the practical exposure is highest where the MQ Console and/or MQ REST API are installed and in use.14

Fixes: what to patch to
IBM states this was addressed under Known Issue DT457904 and provides the following remediation levels:1

Long Term Support (LTS)

• IBM MQ 9.1 LTS: apply cumulative security update (CSU) 9.1.0.345
• IBM MQ 9.2 LTS: apply cumulative security update (CSU) 9.2.0.416
• IBM MQ 9.3 LTS: apply cumulative security update (CSU) 9.3.0.377
• IBM MQ 9.4 LTS: apply fix pack 9.4.0.208

Continuous Delivery (CD)

• IBM MQ 9.3 CD / 9.4 CD: upgrade to IBM MQ 9.4.5 (9.4.5.0) or later.91

Workarounds and mitigations

IBM lists no workarounds or mitigations for this issue; patching or upgrading is the recommended approach.1

Quick triage checklist for MQ admins

1. Confirm whether the MQ Console and/or MQ REST API is installed and exposed in each environment. If the “REST API and Console” component isn’t installed, the bulletin indicates the vulnerable code path may not be present.1
2. Identify whether each environment is on LTS or CD, then map the current fix level to the remediation target above.
3. If you build custom container images: IBM’s component guidance notes that MQ “non-install images” (used for container builds) contain the same components as the full product media at the corresponding level (with limited exceptions). Review your build inputs and ensure they pull the updated fix levels.4

Take the Next Step

If you’re patching this quickly, don’t stop at the fix level—use the same moment to verify your MQ console/REST access controls, browser-facing endpoints, and alerting so the next bulletin doesn’t turn into another fire drill. For a practical hardening checklist, download the guide: Securing Modern IBM MQ Environments.

Endnotes

1. IBM Security Bulletin: IBM MQ is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2025-12635). https://www.ibm.com/support/pages/node/7261943
2. CVE Record: CVE-2025-12635. https://www.cve.org/CVERecord?id=CVE-2025-12635
3. CVSS v3 calculator (FIRST). https://www.first.org/cvss/calculator/3.0
4. Installable component names used in IBM MQ security bulletins. https://www.ibm.com/support/pages/installable-component-names-used-ibm-mq-security-bulletins
5. IBM MQ 9.1 LTS: apply cumulative security update (CSU) 9.1.0.34. https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts
6. IBM MQ 9.2 LTS: apply cumulative security update (CSU) 9.2.0.41. https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts
7. IBM MQ 9.3 LTS: apply cumulative security update (CSU) 9.3.0.37. https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts
8. IBM MQ 9.4 LTS: apply fix pack 9.4.0.20. https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts
9. Downloading IBM MQ 9.4 CD. https://www.ibm.com/support/pages/downloading-ibm-mq-94-cd