CVE-2026-13265
IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.
| CWE | CWE-611 |
| Vendor | ibm |
| Product | mq |
| Published | Sep 14, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for ibm mq
Be the first to know when new medium vulnerabilities affecting ibm mq are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
Affected Versions
IBM / MQ
9.1.0.0 ≤ 9.1.0.37 LTS 9.2.0.0 ≤ 9.2.0.43 LTS 9.3.0.0 ≤ 9.3.0.41 LTS 9.3.0.0 ≤ 9.3.5.1 CD 9.4.0.0 ≤ 9.4.0.25 LTS 9.4.0.0 ≤ 9.4.5.1 CD 10.0.0.0