CVE-2026-13271
Undergoing Analysis Undergoing Analysis - In Progress

IBM MQ XXE Vulnerability in Command Queue Processing

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-13271
EUVD
EUVD-2026-117070

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
IBM MQ 9.2.0.0
IBM MQ 9.3.0.0
IBM MQ 9.4.0.0
IBM MQ 9.4.0.0
IBM MQ 10.0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-13271 is a vulnerability in IBM MQ affecting versions 9.2.0.0 through 10.0.0.5. It involves improper handling of XML external entity references in command queue processing, allowing authenticated attackers to access sensitive information or cause denial of service.

Detection Guidance

Detection involves checking IBM MQ versions against affected ranges and monitoring for unusual XML processing or command queue activity. Review IBM MQ logs for errors related to XML external entity processing or unauthorized access attempts.

Impact Analysis

An attacker could exploit this to steal sensitive data or disrupt services by sending maliciously crafted XML requests. The impact includes potential data breaches and service unavailability.

Mitigation Strategies

Apply the latest security updates: cumulative fixes for 9.2 LTS (9.2.0.46) and 9.3 LTS (9.3.0.43), fix pack 9.4.0.30 for 9.4 LTS, upgrade to 10.0.0.6 for 10.0 LTS, or upgrade to 10.0.1.0 for 9.4 CD and 10.0 CD.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...