Skip to content
Sign in
7.1 High

CVE-2026-13289 IBM MQ Managed File Transfer is vulnerable to XML external entity injection

Description

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
Low

Affected products and versions

Product Affected versions Fixed in
MQ 10.0 10.0.0.0 → 10.0.0.5 No fix stated
MQ 9.4 9.4.0.0 → 9.4.5.1 No fix stated
MQ 9.3 9.3.0.0 → 9.3.0.42 No fix stated
MQ 9.2 9.2.0.0 → 9.2.0.44 No fix stated

Other CVEs of MQ

The 117 CVEs of MQ →
CVE-2026-10859 IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability 7.5 High CVE-2026-11376 IBM MQ is affected by a denial of service vulnerability 8.8 High CVE-2026-11724 IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability 8.5 High CVE-2026-12356 IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability 7.5 High
Track this CVE