Skip to content
OpenAdvisories
High · 7.1 CVE-2026-13285 EUVD-2026-78153GHSA-6fjc-9pf3-r46v

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

Published Sep 14, 2026 · Updated Sep 18, 2026 · Assigned by ibm

Vendor: IBM Product: MQ

Description

IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected products

VendorProductAffectedFixed
IBM MQ 9.1.0.0 – ≤ 9.1.0.37 LTS, 9.2.0.0 – ≤ 9.2.0.43 LTS, 9.3.0.0 – ≤ 9.3.0.41 LTS, 9.3.0.0 – ≤ 9.3.5.1 CD, 9.4.0.0 – ≤ 9.4.0.25 LTS, 9.4.0.0 – ≤ 9.4.5.1 CD, 10.0.0.0 —

Advisories 1

References