Skip to content
OpenAdvisories
High WID-SEC-2026-3365 9 CVEs

IBM MQ: Mehrere Schwachstellen

Published Sep 14, 2026 · Updated Sep 20, 2026 · Revision 2 · de-DE

Vendor: IBM Product: MQ Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.

Product

IBM MQ ist eine Message Oriented Middleware von IBM.

Vulnerabilities 9

  • High 8.8
    CVE-2026-11375

    IBM MQ queue manager is vulnerable to remote code execution

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.

    IBM MQ
  • High 8.8
    CVE-2026-11378

    IBM MQ queue manager is vulnerable to remote code execution

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.

    IBM MQ
  • High 8.8
    CVE-2026-11381

    IBM MQ for HPE NonStop is vulnerable to a denial of service issue

    IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.

    IBM MQ for HPE NonStop
  • High 8.8
    CVE-2026-13293

    IBM MQ Java messaging is vulnerable to remote code execution

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrar…

    IBM MQ
  • High 8.1
    CVE-2026-11726

    IBM MQ for HPE NonStop is vulnerable to a denial of service issue

    IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.

    IBM MQ for HPE NonStop
  • High 7.1
    CVE-2026-13275

    IBM MQ Managed File Transfer is vulnerable to XML external entity injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to …

    IBM MQ
  • High 7.1
    CVE-2026-13285

    IBM MQ Managed File Transfer is vulnerable to XML external entity injection

    IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

    IBM MQ
  • High 7.1
    CVE-2026-13287

    IBM MQ Managed File Transfer is vulnerable to XML external entity injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack …

    IBM MQ
  • Medium 6.8
    CVE-2026-13265

    IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection

    IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authorit…

    IBM MQ

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-83038, EUVD-2026-83037, EUVD-2026-83036, EUVD-2026-83293

  2. #1

    Initiale Fassung

References