---
id: CVE-2026-13292
title: >-
  IBM MQ Managed File Transfer is affected by an arbitrary code execution
  vulnerability
summary: >-
  IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0
  through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through
  10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary
  code by inje…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-15
vendor: IBM
product: MQ
affected:
  - MQ >= 9.2.0.0 <= 9.2.0.44
  - MQ >= 9.3.0.0 <= 9.3.0.42
  - MQ >= 9.4.0.0 <= 9.4.0.26
  - MQ >= 9.4.0.0 <= 9.4.5.1
  - MQ >= 10.0.0.0 <= 10.0.0.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T04:56:21.393994Z'
published: '2026-11-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:38:16.592Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-13292'
references:
  - url: 'https://www.ibm.com/support/pages/node/7294641'
tags:
  - cve.org
epss: 0.00328
epssPercentile: 0.26088
ingestedAt: '2026-11-05T21:36:00.550Z'
---

## Overview

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.

## Affected

- `MQ >= 9.2.0.0 <= 9.2.0.44`
- `MQ >= 9.3.0.0 <= 9.3.0.42`
- `MQ >= 9.4.0.0 <= 9.4.0.26`
- `MQ >= 9.4.0.0 <= 9.4.5.1`
- `MQ >= 10.0.0.0 <= 10.0.0.5`

## Remediation

This issue was addressed under Known Issue DT474692.



IBM MQ version 9.2 LTS



 Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts 



IBM MQ version 9.3 LTS



 Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts 



IBM MQ version 9.4 LTS



 Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94 



IBM MQ version 10.0.LTS



 Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100 



IBM MQ version 9.4 CD and 10.0 CD



 Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100