{"id":"CVE-2026-11724","kind":"vulnerability","aliases":["CVE-2026-11724"],"related":[],"title":"IBM MQ: authenticated users can run code on Managed File Transfer hosts","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.","summary":"IBM MQ's Managed File Transfer agent does not properly validate metadata used when running scripts. An authenticated attacker can use this to execute arbitrary code on the agent host.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-mq","infrastructure","managed-file-transfer","self-hosted"],"not_affected_if":["no-mft-agent","versions-outside-range"],"how_to_check":"- Check the installed IBM MQ version against the affected ranges (`9.2.0.44`, `9.3.0.42`, `9.4.0.26`, `9.4.5.1`, `10.0.0.5`) and confirm whether the Managed File Transfer agent is installed.","fix":"- Move to a fixed release of IBM MQ; the sources list the affected ranges but do not name the fixed versions.","status":"open","published_at":"2026-11-04T21:17:56+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","triaged_at":"2026-11-04T21:50:40+00:00","updated_at":"2026-11-04T21:50:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T21:50:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release of IBM MQ; the sources list the affected ranges but do not name the fixed versions.","reach":"network","title":"IBM MQ: authenticated users can run code on Managed File Transfer hosts","impact":"high","summary":"IBM MQ's Managed File Transfer agent does not properly validate metadata used when running scripts. An authenticated attacker can use this to execute arbitrary code on the agent host.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-mq","managed-file-transfer","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the Managed File Transfer agent host.","analyst_note":"Find the IBM security bulletin for CVE-2026-11724 to get the fixed versions and any interim mitigation for the MFT agent.","how_to_check":"- Check the installed IBM MQ version against the affected ranges (`9.2.0.44`, `9.3.0.42`, `9.4.0.26`, `9.4.5.1`, `10.0.0.5`) and confirm whether the Managed File Transfer agent is installed.\n- unknown for any other check: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["no-mft-agent","versions-outside-range"],"who_is_affected":"Organizations running IBM MQ 9.2, 9.3, 9.4 or 10.0 with the Managed File Transfer agent installed on a host. The attacker needs valid credentials for the product first. Systems without the Managed File Transfer agent are not described as exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4245,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-11724':15A,18A '-2026':14A,17A '10.0.0.0':79C '10.0.0.5':81C '9.2.0.0':62C '9.2.0.44':64C '9.3.0.0':66C '9.3.0.42':68C '9.4.0.0':70C,74C '9.4.0.26':72C '9.4.5.1':76C 'agent':36B,58B,99C 'allow':86C 'arbitrari':54B,92C 'attack':48B,89C 'authent':3A,47B,88C 'cd':77C,84C 'code':7A,55B,93C 'could':85C 'cve':13A,16A 'due':101C 'execut':53B,91C,110C 'file':10A,25B,34B,97C 'host':12A,29B,59B,100C 'ibm':1A,20B,30B,60C 'ibm-mq':19B 'improp':103C 'infrastructur':22B 'lts':65C,69C,73C,82C 'manag':9A,24B,33B,96C 'managed-file-transf':23B 'metadata':41B,106C 'mq':2A,21B,31B,61C 'proper':39B 'run':6A,44B 'script':45B,109C 'self':28B 'self-host':27B 'transfer':11A,26B,35B,98C 'use':42B,50B,107C 'user':4A 'valid':40B,104C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM MQ 9.2, 9.3, 9.4 or 10.0 with the Managed File Transfer agent installed on a host. The attacker needs valid credentials for the product first. Systems without the Managed File Transfer agent are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ibmmq","infrastructure","managedfiletransfer","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T21:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11724","severity":null,"published_at":"2026-11-04T21:17:56+00:00","modified_at":"2026-11-04T21:17:56+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","fetched_at":"2026-11-04T21:49:18+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}