CVE-2026-12666

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS IBM MQ versions 9.2.0.0 through 9.2.0.43 LTS IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions 9.4.0.0 through 9.4.5.1 CD IBM MQ version 10.0.0.0

Description Classes for Java are susceptible to XML external entity injection during the processing of the MQRFH2 header. This allows an authenticated attacker to cause a denial of service or obtain sensitive information. XML external entity injection is a technique where an application processes external entities within an XML document, potentially allowing the inclusion of unauthorized files or triggering server-side requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.