CVE-2026-11724
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Risk Assessment
An authenticated attacker could execute arbitrary code on the MFT agent host, potentially leading to full system compromise and breach of confidentiality and integrity of transferred files. However, valid credentials are required.
Recommendation
Update IBM MQ to the latest version containing the fix. Restrict privileges of accounts used for MFT and monitor for unusual activity.
Other vulnerabilities in IBM MQ
See all- CVE-2026-12351Critical
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
- CVE-2026-18142High
IBM MQ LTS and CD versions contain an integer overflow that could be exploited by a remote authenticated attacker. This may result in a denial of service and limited memory corruption.
- CVE-2026-14252Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.
- CVE-2026-13292High
IBM MQ LTS and CD versions allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. The vulnerability affects the message transfer mechanism.
- CVE-2026-13289High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-13284High
IBM MQ LTS and CD versions are vulnerable to an XML external entity (XXE) attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory resources.
- CVE-2026-12550Medium
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.
- CVE-2026-12538Medium
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
- CVE-2026-12356High
IBM MQ LTS and CD versions allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands. The vulnerability affects command queue processing.
- CVE-2026-11376High
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
Original NVD description (English source)
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS