CVE-2026-13292: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Q: What level of access does an attacker need to exploit this issue?

An attacker must be authenticated and able to submit transfer requests with metadata. No user interaction is required.

Q: Which deployments should be prioritized for review?

Deployments using IBM MQ Managed File Transfer within the listed affected IBM MQ 9.2, 9.3, 9.4, or 10.0 LTS or CD version ranges should be reviewed, particularly where authenticated users can create or control transfer request metadata.

Q: What is the exploitation mechanism?

The issue is triggered by injecting malicious environment variables through transfer request metadata, which can result in arbitrary code execution.

Published Oct 29, 2026

Updated

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.

Other sources

IBM MQ Managed File Transfer could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.

— IBM

Affected Software

5 affected components

IBM MQ<=9.2.0.0 to 9.2.0.44 LTS

IBM MQ<=9.3.0.0 to 9.3.0.42 LTS

IBM MQ<=9.4.0.0 to 9.4.0.26 LTS

IBM MQ<=9.4.0.0 to 9.4.5.1 CD

IBM MQ<=10.0.0.0 to 10.0.0.5 LTS and CD

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM MQ Managed File Transfer to a version that resolves this vulnerability.
Fixed in 9.2.0.46
Upgrade
Upgrade IBM MQ Managed File Transfer to a version that resolves this vulnerability.
Fixed in 9.3.0.43
Upgrade
Upgrade IBM MQ Managed File Transfer to a version that resolves this vulnerability.
Fixed in 9.4.0.30
Upgrade
Upgrade IBM MQ Managed File Transfer to a version that resolves this vulnerability.
Fixed in 10.0.0.6
Upgrade
Upgrade IBM MQ Managed File Transfer to a version that resolves this vulnerability.
Fixed in 10.0.1.0

Event History

Oct 29, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 4, 2026

CVE Published

via MITRE·08:24 PM

Data Sourced

via MITRE·08:24 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:18 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294641

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must be authenticated and able to submit transfer requests with metadata. No user interaction is required.

Which deployments should be prioritized for review?

Deployments using IBM MQ Managed File Transfer within the listed affected IBM MQ 9.2, 9.3, 9.4, or 10.0 LTS or CD version ranges should be reviewed, particularly where authenticated users can create or control transfer request metadata.

What is the exploitation mechanism?

The issue is triggered by injecting malicious environment variables through transfer request metadata, which can result in arbitrary code execution.

CVE-2026-13292: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be prioritized for review?

What is the exploitation mechanism?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be prioritized for review?

What is the exploitation mechanism?