IBMCVE-2026-13287
IBM MQ: XML external entity
High7.1CVE-2026-13287 · Published Sep 14, 2026 · updated Sep 16, 2026
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MQ Product | >= 9.1.0.0, <= 9.1.0.37 LTS | No fix yet |
| >= 9.2.0.0, <= 9.2.0.43 LTS | No fix yet | |
| >= 9.3.0.0, <= 9.3.0.41 LTS | No fix yet | |
| >= 9.3.0.0, <= 9.3.5.1 CD | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-611
More IBM advisories
All IBM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 14 | IBM MQ: information disclosure | Medium6.8 | No fix yet |
| Sep 14 | IBM Business Automation Workflow containers and traditional: XML external entity | High7.1 | No fix yet |
| Sep 14 | IBM Cloud Pak for Business Automation: missing authorization | Medium5.4 | No fix yet |
| Sep 14 | IBM Cloud Pak for Business Automation: denial of service | Medium6.5 | No fix yet |
| Sep 14 | IBM Langflow OSS: server-side request forgery | Critical9.6 | No fix yet |
| Sep 14 | IBM Sterling Secure Proxy: improper authorization | Medium4.3 | No fix yet |