CVE-2026-13289

Undergoing Analysis Undergoing Analysis - In Progress

XXE Vulnerability in IBM MQ Software

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-13289

EUVD

EUVD-2026-117068

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	MQ	9.2.0.0
IBM	MQ	9.3.0.0
IBM	MQ	9.4.0.0
IBM	MQ	9.4.0.0
IBM	MQ	10.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This is an XML External Entity (XXE) injection vulnerability in IBM MQ versions 9.2.0.0 through 10.0.0.5. It occurs when the system processes XML data without proper restrictions on external entity references. A remote attacker can exploit this to read sensitive files or consume excessive memory resources.

Detection Guidance

Detecting this vulnerability requires checking the IBM MQ Managed File Transfer component versions. Use commands like 'dspmqver' or 'mqver' to list installed IBM MQ versions. Compare the output against affected versions (9.2.0.0-9.2.0.44, 9.3.0.0-9.3.0.42, 9.4.0.0-9.4.0.26, 9.4.0.0-9.4.5.1, 10.0.0.0-10.0.0.5).

Monitor network traffic for unusual XML parsing requests or excessive memory consumption in IBM MQ processes. Check logs for errors related to XML external entity processing.

Impact Analysis

An attacker could steal sensitive data like configuration files or user credentials. It may also cause system slowdowns or crashes by consuming too much memory, disrupting normal operations.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance risks fines and legal penalties.

Mitigation Strategies

Apply the latest cumulative security updates for your IBM MQ version: 9.2.0.46 for 9.2 LTS, 9.3.0.43 for 9.3 LTS, 9.4.0.30 for 9.4 LTS, or upgrade to 10.0.0.6 LTS or 10.0.1.0 CD.

If immediate patching is not possible, restrict network access to the IBM MQ Managed File Transfer component and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-13289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...