XML External Entity Injection in IBM MQ
CVE-2026-13265

6.8MEDIUM

Key Information:

Vendor

IBM
Status
MQ
Vendor
CVE Published:
14 September 2026

What is CVE-2026-13265?

An XML external entity injection vulnerability exists in the IBM MQ MFT REST API, allowing an authenticated attacker with publish authority to exploit this flaw. This can lead to unauthorized access to sensitive information or may result in a denial of service condition, affecting the availability of the service. The vulnerability impacts several versions of IBM MQ, underscoring the necessity for users to update their systems to mitigate risks associated with this security issue.

Affected Version(s)

MQ 9.1.0.0 <= 9.1.0.37 LTS

MQ 9.2.0.0 <= 9.2.0.43 LTS

MQ 9.3.0.0 <= 9.3.0.41 LTS

References

https://www.ibm.com/support/pages/node/7284895
vendor-advisorypatch

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.