CVE-2026-11724 · Infrastructure
NO FIX YET · SEE WHAT TO DO
IBM MQ's Managed File Transfer agent does not properly validate metadata used when running scripts. An authenticated attacker can use this to execute arbitrary code on the agent host.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running IBM MQ 9.2, 9.3, 9.4 or 10.0 with the Managed File Transfer agent installed on a host. The attacker needs valid credentials for the product first. Systems without the Managed File Transfer agent are not described as exposed.
Not affected if no-mft-agent, versions-outside-range
Who cares ibm-mq, managed-file-transfer, self-hosted
9.2.0.44, 9.3.0.42, 9.4.0.26, 9.4.5.1, 10.0.0.5) and confirm whether the Managed File Transfer agent is installed.IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.