CVE-2026-13265

Summary

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.

Affected Software

VendorProductVersion RangeStatus
IBMMQ9.1.0.0 <= 9.1.0.37 LTSaffected
IBMMQ9.2.0.0 <= 9.2.0.43 LTSaffected
IBMMQ9.3.0.0 <= 9.3.0.41 LTSaffected
IBMMQ9.3.0.0 <= 9.3.5.1 CDaffected
IBMMQ9.4.0.0 <= 9.4.0.25 LTSaffected
IBMMQ9.4.0.0 <= 9.4.5.1 CDaffected
IBMMQ10.0.0.0affected

Weaknesses

  • CWE-611: CWE-611 Improper Restriction of XML External Entity Reference

References