CVE-2026-13287

Received Received - Intake

XXE Vulnerability in IBM MQ Software

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-13287

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	mq	From 9.1.0.0 (inc) to 9.1.0.37 (inc)
ibm	mq	From 9.2.0.0 (inc) to 9.2.0.43 (inc)
ibm	mq	From 9.3.0.0 (inc) to 9.3.0.41 (inc)
ibm	mq	From 9.3.0.0 (inc) to 9.3.5.1 (inc)
ibm	mq	From 9.4.0.0 (inc) to 9.4.0.25 (inc)
ibm	mq	From 9.4.0.0 (inc) to 9.4.5.1 (inc)
ibm	mq	10.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML External Entity (XXE) injection flaw in IBM MQ versions 9.1.0.0 through 10.0.0.0. It allows a remote attacker to process malicious XML data, potentially exposing sensitive information or consuming excessive memory resources.

Impact Analysis

An attacker could exploit this to read sensitive files, access internal systems, or cause denial-of-service by consuming memory. Systems processing untrusted XML files are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must address it to maintain compliance.

Mitigation Strategies

Apply the latest IBM MQ patches for your version immediately. Disable XML processing features if not required. Monitor network traffic for unusual XML data exchanges. Restrict access to IBM MQ services to trusted networks only.

Hi! I’m here to help you understand CVE-2026-13287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70