CVE-2026-13287
HighCVSS 7.1Summary
IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.
Risk Assessment
A remote attacker can exploit XXE to read confidential data or cause system overload, threatening confidentiality and availability.
Recommendation
Install IBM MQ updates that fix the XXE vulnerability and restrict processing of untrusted XML data.
Other vulnerabilities in IBM MQ
See all- CVE-2026-13265Medium
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.
- CVE-2026-13293High
IBM MQ versions LTS and CD up to 10.0.0.0 allow a remote authenticated attacker to execute arbitrary code on the system due to deserialization of untrusted data.
- CVE-2026-13285High
IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.
- CVE-2026-13275High
IBM MQ Managed File Transfer versions LTS and CD up to 10.0.0.0 allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.
Original NVD description (English source)
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.