XML External Entity Injection Vulnerability in IBM MQ Products
CVE-2026-13285

7.1HIGH

Key Information:

Vendor

IBM
Status
MQ
Vendor
CVE Published:
14 September 2026

What is CVE-2026-13285?

IBM MQ versions 9.1 through 10.0 are susceptible to XML external entity injection attacks due to improper handling of XML data. An attacker exploiting this vulnerability could potentially access sensitive information or exhaust system memory resources, leading to service disruption. It is crucial for users of affected IBM MQ versions to implement available security patches and mitigate this risk to protect their systems.

Affected Version(s)

MQ 9.1.0.0 <= 9.1.0.37 LTS

MQ 9.2.0.0 <= 9.2.0.43 LTS

MQ 9.3.0.0 <= 9.3.0.41 LTS

References

https://www.ibm.com/support/pages/node/7284940
vendor-advisorypatch

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.