CVE-2026-12667

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS IBM MQ versions 9.2.0.0 through 9.2.0.43 LTS IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions 9.4.0.0 through 9.4.5.1 CD IBM MQ version 10.0.0.0

Description An authenticated attacker can read files from a .NET client or cause a limited denial of service. This is caused by the improper handling of XML External Entities (XXE) during the parsing of RFH2 folders. XXE is a type of attack where an application processes external entity references within an XML document, potentially allowing access to unauthorized files or system resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.