CVE-2026-13289: IBM MQ Managed File Transfer is vulnerable to XML external entity injection
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Other sources
IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.2.0.46 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.3.0.43 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.4.0.30 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.0.6 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.1.0
Event History
Frequently Asked Questions
Which IBM MQ releases are affected?
Affected releases are 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 in both LTS and CD.
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable with low attack complexity and requires low privileges. It does not require user interaction.
What could successful exploitation allow?
An attacker could use crafted XML processing to expose sensitive information or consume memory resources. The reported impact includes high confidentiality impact and low availability impact.