CVE-2026-11724: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Q: Which deployments are exposed to this issue?

Managed File Transfer agent hosts running IBM MQ in the listed affected LTS or CD version ranges are exposed. The issue is specifically tied to metadata used during script execution on the agent host.

Q: What access does an attacker need?

An attacker must be authenticated and have the ability to supply or influence the relevant metadata. No user interaction is required, but exploitation has high attack complexity according to the supplied vector.

Q: What is the potential impact if exploitation succeeds?

A successful attacker can execute arbitrary code on the Managed File Transfer agent host. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability, with impact extending beyond the vulnerable component.

Published Oct 29, 2026

Updated

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.

Other sources

IBM MQ could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.

— IBM

Affected Software

5 affected components

IBM MQ<=9.2.0.0 to 9.2.0.44 LTS

IBM MQ<=9.3.0.0 to 9.3.0.42 LTS

IBM MQ<=9.4.0.0 to 9.4.0.26 LTS

IBM MQ<=9.4.0.0 to 9.4.5.1 CD

IBM MQ<=10.0.0.0 to 10.0.0.5 LTS and CD

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 9.2.0.46
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 9.3.0.43
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 9.4.0.30
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 10.0.0.6
Upgrade
Upgrade IBM MQ to a version that resolves this vulnerability.
Fixed in 10.0.1.0

Event History

Oct 29, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 4, 2026

CVE Published

via MITRE·08:25 PM

Data Sourced

via MITRE·08:25 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294503

Frequently Asked Questions

Which deployments are exposed to this issue?

Managed File Transfer agent hosts running IBM MQ in the listed affected LTS or CD version ranges are exposed. The issue is specifically tied to metadata used during script execution on the agent host.

What access does an attacker need?

An attacker must be authenticated and have the ability to supply or influence the relevant metadata. No user interaction is required, but exploitation has high attack complexity according to the supplied vector.

What is the potential impact if exploitation succeeds?

A successful attacker can execute arbitrary code on the Managed File Transfer agent host. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability, with impact extending beyond the vulnerable component.

CVE-2026-11724: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the potential impact if exploitation succeeds?