Description
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | MQ | 9.1.0.0 – ≤ 9.1.0.37 LTS, 9.2.0.0 – ≤ 9.2.0.43 LTS, 9.3.0.0 – ≤ 9.3.0.41 LTS, 9.3.0.0 – ≤ 9.3.5.1 CD, 9.4.0.0 – ≤ 9.4.0.25 LTS, 9.4.0.0 – ≤ 9.4.5.1 CD, 10.0.0.0 | — |
Advisories 1
- WID-SEC-2026-3365 IBM MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 20, 2026
References
- https://www.ibm.com/support/pages/node/7284895 vendor-advisory patch