CVE-2026-12667: IBM MQ .NET client is vulnerable to XML external entity injection
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.
Other sources
IBM MQ could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.1.0.38 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0.44 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.3.0.42 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.4.0.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.0.5
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to vulnerable IBM MQ .NET clients in the listed affected IBM MQ LTS and CD releases, including 10.0.0.0. The issue occurs when those clients parse RFH2 folders containing XML.
What does an attacker need to exploit this issue?
The attacker must be authenticated. The published vector indicates network reachability, low attack complexity, and no user interaction requirement.
What is the likely impact on an affected client?
An authenticated attacker may be able to read files from the vulnerable .NET client. They may also cause limited denial of service; integrity impact is not indicated.
How can I identify potentially affected systems?
Identify systems using the IBM MQ .NET client and compare their IBM MQ release level with the affected ranges: 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS or 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS or 9.4.5.1 CD, and 10.0.0.0. Systems outside the .NET client context are not identified as affected by the provided information.