IBM MQ 9.3 LTS
IBM MQ 9.3 LTS
Third-party support for the IBM MQ 9.3 LTS: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
24/7 engineers own your IBM MQ 9.3 LTS incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- ibm-mq
- release
- 9.3
- product Label
- IBM MQ
- release Label
- IBM MQ 9.3 LTS
- codename
- lts
- latest Version
- release Date
- 2022-06-23
- maintained
- true
- source Url
- https://endoflife.date/ibm-mq
Lifecycle Dates
- End of Service Life
- Sep 30, 2031
- Last OEM Support
- Sep 30, 2027
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for IBM MQ 9.3 LTS — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for IBM MQ 9.3 LTS?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for IBM MQ 9.3 LTS when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
IBM MQ 9.3 LTS Support: Frequently Asked Questions
Is the IBM MQ 9.3 LTS still supported?
Yes. The IBM MQ 9.3 LTS is currently supported by IBM, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
When is the IBM MQ 9.3 LTS end of service life (EOSL) date?
IBM lists the end of service life for the IBM MQ 9.3 LTS as Sep 30, 2031.
Can I keep using the IBM MQ 9.3 LTS after its EOSL date?
Yes. EOSL means IBM stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the IBM MQ 9.3 LTS cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location. You get an indicative price within 24 hours and a firm quote within 48.
Known Vulnerabilities Affecting IBM MQ 9.3 LTS
25 published CVEs affect the IBM MQ 9.3 LTS, including 10 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-11378 | HIGH | 8.8 | Sep 18, 2026 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing. |
| CVE-2026-11375 | HIGH | 8.8 | Sep 18, 2026 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers. |
| CVE-2026-10575 | HIGH | 8.8 | Sep 18, 2026 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers. |
| CVE-2026-10027 | HIGH | 8.1 | Sep 18, 2026 | IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled. |
| CVE-2026-10853 | HIGH | 7.5 | Sep 18, 2026 | IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths. |
| CVE-2025-36128 | HIGH | 7.5 | Oct 16, 2025 | IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service. |
| CVE-2024-31912 | HIGH | 7.5 | Jun 28, 2024 | IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. IBM X-Force ID: 289894. |
| CVE-2024-25015 | HIGH | 7.5 | May 1, 2024 | IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. IBM X-Force ID: 281278. |
| CVE-2024-25016 | HIGH | 7.5 | Mar 3, 2024 | IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Force ID: 281279. |
| CVE-2026-18142 | HIGH | 7.1 | Nov 4, 2026 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow. |
| CVE-2024-35156 | MEDIUM | 6.5 | Jun 28, 2024 | IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292766. |
| CVE-2024-35155 | MEDIUM | 6.5 | Jun 28, 2024 | IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292765. |
| CVE-2024-52898 | MEDIUM | 6.2 | Jan 14, 2025 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned. |
| CVE-2024-52897 | MEDIUM | 6.2 | Dec 19, 2024 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. |
| CVE-2024-52896 | MEDIUM | 6.2 | Dec 19, 2024 | IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. |
| CVE-2024-35116 | MEDIUM | 5.9 | Jun 28, 2024 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. IBM X-Force ID: 290335. |
| CVE-2024-31919 | MEDIUM | 5.9 | Jun 28, 2024 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API Exit using MQBUFMH is used. IBM X-Force ID: 290259. |
| CVE-2023-28513 | MEDIUM | 5.9 | Jul 19, 2023 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 250397. |
| CVE-2025-0985 | MEDIUM | 5.5 | Feb 28, 2025 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user. |
| CVE-2024-54175 | MEDIUM | 5.5 | Feb 28, 2025 | IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions. |
Showing the 20 most severe of 25 known CVEs.
Get Third Party SupportIBM MQ: every version and its end of support date
The IBM MQ 9.3 LTS is one of the IBM MQ versions in our catalog. The lifecycle page lists every version with its vendor end-of-support date, what changes on that date, and what third-party support covers.