CVE-2026-13275

Summary

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.

Affected Software

VendorProductVersion RangeStatus
IBMMQ9.1.0.0 <= 9.1.0.37 LTSaffected
IBMMQ9.2.0.0 <= 9.2.0.43 LTSaffected
IBMMQ9.3.0.0 <= 9.3.0.41 LTSaffected
IBMMQ9.3.0.0 <= 9.3.5.1 CDaffected
IBMMQ9.4.0.0 <= 9.4.0.25 LTSaffected
IBMMQ9.4.0.0 <= 9.4.5.1 CDaffected
IBMMQ10.0.0.0affected

Weaknesses

  • CWE-611: CWE-611 Improper Restriction of XML External Entity Reference

References