CVE-2026-13289 PUBLISHED

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

Assigner: ibm
Reserved: 24.06.2026 Published: 04.11.2026 Updated: 04.11.2026

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CVSS Score: 7.1

Product Status

Vendor IBM
Product MQ
Versions
  • affected from 9.2.0.0 to 9.2.0.44 (incl.)
  • affected from 9.3.0.0 to 9.3.0.42 (incl.)
  • affected from 9.4.0.0 to 9.4.0.26 (incl.)
  • affected from 9.4.0.0 to 9.4.5.1 (incl.)
  • affected from 10.0.0.0 to 10.0.0.5 (incl.)

Solutions

This issue was addressed under Known Issue DT474700.

IBM MQ version 9.2 LTS

Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts

IBM MQ version 9.3 LTS

Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts

IBM MQ version 9.4 LTS

Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94

IBM MQ version 10.0.LTS

Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100

IBM MQ version 9.4 CD and 10.0 CD

Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

References

Problem Types

  • CWE-611 Improper Restriction of XML External Entity Reference CWE