CVE-2026-13292 PUBLISHED

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Assigner: ibm
Reserved: 24.06.2026 Published: 04.11.2026 Updated: 04.11.2026

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor IBM
Product MQ
Versions
  • affected from 9.2.0.0 to 9.2.0.44 (incl.)
  • affected from 9.3.0.0 to 9.3.0.42 (incl.)
  • affected from 9.4.0.0 to 9.4.0.26 (incl.)
  • affected from 9.4.0.0 to 9.4.5.1 (incl.)
  • affected from 10.0.0.0 to 10.0.0.5 (incl.)

Solutions

This issue was addressed under Known Issue DT474692.

IBM MQ version 9.2 LTS

Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts

IBM MQ version 9.3 LTS

Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts

IBM MQ version 9.4 LTS

Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94

IBM MQ version 10.0.LTS

Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100

IBM MQ version 9.4 CD and 10.0 CD

Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

References

Problem Types

  • CWE-15 External Control of System or Configuration Setting CWE