CVE-2026-13292
Undergoing Analysis Undergoing Analysis - In Progress

IBM MQ Remote Code Execution via Environment Variable Injection

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-13292
EUVD
EUVD-2026-117067

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
IBM MQ 9.2.0.0
IBM MQ 9.3.0.0
IBM MQ 9.4.0.0
IBM MQ 9.4.0.0
IBM MQ 10.0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-15 One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-13292 is an arbitrary code execution vulnerability in IBM MQ's Managed File Transfer feature. An authenticated attacker can inject malicious environment variables through transfer request metadata to execute arbitrary code on affected systems.

Detection Guidance

Detecting this vulnerability requires checking the installed IBM MQ version and whether the Managed File Transfer feature is enabled. Review IBM MQ logs for suspicious transfer requests with unusual metadata. Use commands like 'dspmqver' to check versions and 'mqsilist' to inspect Managed File Transfer components.

Impact Analysis

This vulnerability allows attackers to run malicious code on your system if you use IBM MQ with Managed File Transfer. It could lead to unauthorized access, data theft, or system compromise. The high CVSS score of 8.8 indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest security updates immediately: For IBM MQ 9.2 LTS, install 9.2.0.46. For 9.3 LTS, install 9.3.0.43. For 9.4 LTS, install fix pack 9.4.0.30. Upgrade 10.0 LTS to 10.0.0.6. For 9.4 CD and 10.0 CD, upgrade to 10.0.1.0. Disable the Managed File Transfer feature if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...