IBM MQ vulnerabilities
5 known CVE vulnerabilities in IBM MQ, translated and rated.
- CVE-2026-13265Medium
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.
- CVE-2026-13293High
IBM MQ versions LTS and CD up to 10.0.0.0 allow a remote authenticated attacker to execute arbitrary code on the system due to deserialization of untrusted data.
- CVE-2026-13287High
IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.
- CVE-2026-13285High
IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.
- CVE-2026-13275High
IBM MQ Managed File Transfer versions LTS and CD up to 10.0.0.0 allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.