CVE-2026-13271: IBM MQ Managed File Transfer is affected by a denial of service vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.
Other sources
IBM MQ Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQ Managed File Transferto a version that resolves this vulnerability.Fixed in 9.2.0.46 - Upgrade
Upgrade
IBM MQ Managed File Transferto a version that resolves this vulnerability.Fixed in 9.3.0.43 - Upgrade
Upgrade
IBM MQ Managed File Transferto a version that resolves this vulnerability.Fixed in 9.4.0.30 - Upgrade
Upgrade
IBM MQ Managed File Transferto a version that resolves this vulnerability.Fixed in 10.0.0.6 - Upgrade
Upgrade
IBM MQ Managed File Transferto a version that resolves this vulnerability.Fixed in 10.0.1.0
Event History
Frequently Asked Questions
Is unauthenticated exploitation indicated?
No. The supplied CVSS vector and advisory description indicate that an attacker must be authenticated and have low privileges; no user interaction is required.
What access path is involved in exploitation?
The issue is associated with improper restriction of XML external entity references during command queue processing in Managed File Transfer.
Are availability effects clearly characterized?
The advisory description says exploitation could cause a denial of service, while the supplied CVSS vector records no availability impact and high confidentiality and integrity impact. Teams should account for this discrepancy when prioritizing operational risk.