---
id: "CVE-2026-11724"
kind: "vulnerability"
aliases: ["CVE-2026-11724"]
title: "IBM MQ: authenticated users can run code on Managed File Transfer hosts"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-mq", "infrastructure", "managed-file-transfer", "self-hosted"]
not_affected_if: ["no-mft-agent", "versions-outside-range"]
published_at: "2026-11-04T21:17:56+00:00"
first_seen_at: "2026-11-04T21:49:18+00:00"
updated_at: "2026-11-04T21:50:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11724", "first_seen_at": "2026-11-04T21:49:18+00:00"}]
exploit_sources: []
---

# IBM MQ: authenticated users can run code on Managed File Transfer hosts

IBM MQ's Managed File Transfer agent does not properly validate metadata used when running scripts. An authenticated attacker can use this to execute arbitrary code on the agent host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM MQ version against the affected ranges (`9.2.0.44`, `9.3.0.42`, `9.4.0.26`, `9.4.5.1`, `10.0.0.5`) and confirm whether the Managed File Transfer agent is installed.

## Fix

- Move to a fixed release of IBM MQ; the sources list the affected ranges but do not name the fixed versions.

## Timeline

- 2026-11-04T21:49:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11724

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_