CVE-2026-13265

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS IBM MQ versions 9.2.0.0 through 9.2.0.43 LTS IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions 9.4.0.0 through 9.4.5.1 CD IBM MQ version 10.0.0.0

Description An authenticated attacker with MFT publish authority can obtain sensitive information or cause a denial of service. This is possible due to XML external entity injection in the mqweb MFT REST API. XML external entity injection is a technique where an application processes external entities within an XML document, potentially allowing the attacker to read local files or interact with internal systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.