CVE-2026-11724 PUBLISHED

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Assigner: ibm
Reserved: 09.06.2026 Published: 04.11.2026 Updated: 04.11.2026

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.5

Product Status

Vendor IBM
Product MQ
Versions
  • affected from 9.2.0.0 to 9.2.0.44 (incl.)
  • affected from 9.3.0.0 to 9.3.0.42 (incl.)
  • affected from 9.4.0.0 to 9.4.0.26 (incl.)
  • affected from 9.4.0.0 to 9.4.5.1 (incl.)
  • affected from 10.0.0.0 to 10.0.0.5 (incl.)

Solutions

This issue was addressed under Known Issue DT473347.

IBM MQ version 9.2 LTS

Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts

IBM MQ version 9.3 LTS

Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts

IBM MQ version 9.4 LTS

Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94

IBM MQ version 10.0.LTS

Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100

IBM MQ version 9.4 CD and 10.0 CD

Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

References

Problem Types

  • CWE-20 Improper Input Validation CWE