CVE-2026-13265

Received Received - Intake

IBM MQ MFT REST API XXE Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: IBM Corporation

Description

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-13265

EUVD

EUVD-2026-78155

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	mq	From 9.1.0.0 (inc) to 9.1.0.37 (inc)
ibm	mq	From 9.2.0.0 (inc) to 9.2.0.43 (inc)
ibm	mq	From 9.3.0.0 (inc) to 9.3.0.41 (inc)
ibm	mq	From 9.3.0.0 (inc) to 9.3.5.1 (inc)
ibm	mq	From 9.4.0.0 (inc) to 9.4.0.25 (inc)
ibm	mq	From 9.4.0.0 (inc) to 9.4.5.1 (inc)
ibm	mq	10.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML External Entity (XXE) injection flaw in IBM MQ versions 9.1.0.0 through 10.0.0.0. An authenticated attacker with MFT publish authority can exploit this to read sensitive files or cause a denial of service via the mqweb MFT REST API.

Detection Guidance

This vulnerability involves XML external entity injection in IBM MQ's MFT REST API. Detection requires checking for unusual XML parsing behavior or unauthorized data access in MQ logs. Review IBM MQ documentation for MFT REST API logs and enable verbose XML parsing logging if available. No specific commands are provided in the context.

Impact Analysis

An attacker could access sensitive system files or disrupt MQ services. This may lead to data breaches, service outages, or unauthorized information disclosure if exploited.

Compliance Impact

This vulnerability could allow unauthorized access to sensitive information or disruption of services, which may violate data protection requirements under GDPR (e.g., unauthorized data access) and HIPAA (e.g., exposure of protected health information).

Mitigation Strategies

Apply the latest IBM MQ patches for your version to address the XML external entity injection vulnerability in the mqweb MFT REST API. IBM MQ 9.1.0.38 LTS, 9.2.0.44 LTS, 9.3.0.42 LTS, 9.3.5.2 CD, 9.4.0.26 LTS, 9.4.5.2 CD, and 10.0.0.1 address this issue.

Hi! I’m here to help you understand CVE-2026-13265. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70