---
id: CVE-2026-11724
title: >-
  IBM MQ Managed File Transfer is affected by an arbitrary code execution
  vulnerability
summary: >-
  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0
  through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through
  10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary
  code on a Ma…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-20
vendor: IBM
product: MQ
affected:
  - MQ >= 9.2.0.0 <= 9.2.0.44
  - MQ >= 9.3.0.0 <= 9.3.0.42
  - MQ >= 9.4.0.0 <= 9.4.0.26
  - MQ >= 9.4.0.0 <= 9.4.5.1
  - MQ >= 10.0.0.0 <= 10.0.0.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T04:56:23.744467Z'
published: '2026-11-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:37:47.793Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-11724'
references:
  - url: 'https://www.ibm.com/support/pages/node/7294503'
tags:
  - cve.org
epss: 0.00284
epssPercentile: 0.21064
ingestedAt: '2026-11-05T21:36:00.554Z'
---

## Overview

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.

## Affected

- `MQ >= 9.2.0.0 <= 9.2.0.44`
- `MQ >= 9.3.0.0 <= 9.3.0.42`
- `MQ >= 9.4.0.0 <= 9.4.0.26`
- `MQ >= 9.4.0.0 <= 9.4.5.1`
- `MQ >= 10.0.0.0 <= 10.0.0.5`

## Remediation

This issue was addressed under Known Issue DT473347.



IBM MQ version 9.2 LTS



 Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts 



IBM MQ version 9.3 LTS



 Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts 



IBM MQ version 9.4 LTS



 Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94 



IBM MQ version 10.0.LTS



 Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100 



IBM MQ version 9.4 CD and 10.0 CD



 Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100