Feed Trends Digest

Am I affected?CVSS calculator

API docs MCP server OpenAPI llms.txt RSS

VulnSea · CVE intelligence for humans and agents · data from NVD, CVE.org, GitHub Advisory Database, FIRST EPSS, CISA KEV and others — full attribution. This product uses the NVD API but is not endorsed or certified by the NVD.

For agents:llms.txt OpenAPI digest RSS

About Trends Digest Status Blog Privacy Terms Sponsor

Informational only. Verify against the official advisory before acting.

© 2026 VulnSea. All rights reserved.

← Back to feed

Depth

8.1Twilight

CVE-2026-13271High· 8.1▾ Twilight

IBM MQ Managed File Transfer is affected by a denial of service vulnerability

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain s…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 44.6 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 4, 2026

Updated

Nov 4, 2026

CVSS

8.1

Vendor

IBM

Product

MQ

CWE

CWE-611

Depth score

45 · Moderate

EPSS

0.23% · p14

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Nov 6.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 2 days

Nov 4, 2026Published
Disclosed via CVEORG
Nov 6, 2026EPSS first tracked
0.2%

IBM CWE-611 #cve.org

Affected

MQ >= 9.2.0.0 <= 9.2.0.44
MQ >= 9.3.0.0 <= 9.3.0.42
MQ >= 9.4.0.0 <= 9.4.0.26
MQ >= 9.4.0.0 <= 9.4.5.1
MQ >= 10.0.0.0 <= 10.0.0.5

Full technical detail▾

Overview

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.

Affected

MQ >= 9.2.0.0 <= 9.2.0.44
MQ >= 9.3.0.0 <= 9.3.0.42
MQ >= 9.4.0.0 <= 9.4.0.26
MQ >= 9.4.0.0 <= 9.4.5.1
MQ >= 10.0.0.0 <= 10.0.0.5

Remediation

This issue was addressed under Known Issue DT474627.

IBM MQ version 9.2 LTS

Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts

IBM MQ version 9.3 LTS

Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts

IBM MQ version 9.4 LTS

Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94

IBM MQ version 10.0.LTS

Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100

IBM MQ version 9.4 CD and 10.0 CD

Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

References

https://www.ibm.com/support/pages/node/7294654

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

CVE-2026-13284High· 7.1
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
same productCWE-611#cve.org
CVE-2026-13289High· 7.1
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
same productCWE-611#cve.org
CVE-2026-12666High· 8.1
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authentic…
same productCWE-611#cve.org
CVE-2026-12667High· 7.1
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to …
same productCWE-611#cve.org
CVE-2026-13265Medium· 6.8
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker wit…
same productCWE-611#cve.org
CVE-2026-13287High· 7.1
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity i…
same productCWE-611#cve.org

#cve.org