Feed Trends Digest

Am I affected?CVSS calculator

API docs MCP server OpenAPI llms.txt RSS

VulnSea · CVE intelligence for humans and agents · data from NVD, CVE.org, GitHub Advisory Database, FIRST EPSS, CISA KEV and others — full attribution. This product uses the NVD API but is not endorsed or certified by the NVD.

For agents:llms.txt OpenAPI digest RSS

About Trends Digest Status Blog Privacy Terms Sponsor

Informational only. Verify against the official advisory before acting.

© 2026 VulnSea. All rights reserved.

← Back to feed

Depth

7.1Twilight

CVE-2026-13289High· 7.1▾ Twilight

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when pro…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score39/ 100 · Low

impact 39.1 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 4, 2026

Updated

Nov 4, 2026

CVSS

7.1

Vendor

IBM

Product

MQ

CWE

CWE-611

Depth score

39 · Low

EPSS

0.36% · p30

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Nov 6.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 2 days

Nov 4, 2026Published
Disclosed via CVEORG
Nov 6, 2026EPSS first tracked
0.4%

IBM CWE-611 #cve.org

Affected

MQ >= 9.2.0.0 <= 9.2.0.44
MQ >= 9.3.0.0 <= 9.3.0.42
MQ >= 9.4.0.0 <= 9.4.0.26
MQ >= 9.4.0.0 <= 9.4.5.1
MQ >= 10.0.0.0 <= 10.0.0.5

Full technical detail▾

Overview

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected

MQ >= 9.2.0.0 <= 9.2.0.44
MQ >= 9.3.0.0 <= 9.3.0.42
MQ >= 9.4.0.0 <= 9.4.0.26
MQ >= 9.4.0.0 <= 9.4.5.1
MQ >= 10.0.0.0 <= 10.0.0.5

Remediation

This issue was addressed under Known Issue DT474700.

IBM MQ version 9.2 LTS

Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts

IBM MQ version 9.3 LTS

Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts

IBM MQ version 9.4 LTS

Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94

IBM MQ version 10.0.LTS

Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100

IBM MQ version 9.4 CD and 10.0 CD

Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

References

https://www.ibm.com/support/pages/node/7294499

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

CVE-2026-13271High· 8.1
IBM MQ Managed File Transfer is affected by a denial of service vulnerability
same productCWE-611#cve.org
CVE-2026-13284High· 7.1
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
same productCWE-611#cve.org
CVE-2026-12666High· 8.1
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authentic…
same productCWE-611#cve.org
CVE-2026-12667High· 7.1
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to …
same productCWE-611#cve.org
CVE-2026-13265Medium· 6.8
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker wit…
same productCWE-611#cve.org
CVE-2026-13287High· 7.1
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity i…
same productCWE-611#cve.org

#cve.org