{"id":"CVE-2026-13271","kind":"vulnerability","aliases":["CVE-2026-13271"],"related":[],"title":"IBM MQ: XML entity flaw leaks data or crashes Managed File Transfer","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.","summary":"IBM MQ's Managed File Transfer component does not restrict XML external entity references when processing command queue messages. An authenticated attacker can read sensitive information or cause a denial of service.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM MQ","fixed":["9.2.0.46","9.3.0.43","9.4.0.30","10.0.0.6","10.0.1.0"],"affected":"9.2.0.0-9.2.0.44 LTS; 9.3.0.0-9.3.0.42 LTS; 9.4.0.0-9.4.0.26 LTS; 9.4.0.0-9.4.5.1 CD; 10.0.0.0-10.0.0.5 LTS and CD (Managed File Transfer component)","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-messaging","ibm-mq","managed-file-transfer","package","self-hosted","xxe"],"not_affected_if":["auth-required","default-config","no-managed-file-transfer"],"how_to_check":"Run dspmqver on each MQ host and compare with: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD. Only installs with the Managed File Transfer component are affected; confirm whether that component is installed on the host.","fix":"Apply per branch: 9.2 LTS cumulative security update 9.2.0.46; 9.3 LTS 9.3.0.43; 9.4 LTS fix pack 9.4.0.30; 10.0 LTS upgrade to 10.0.0.6; 9.4 CD and 10.0 CD upgrade to 10.0.1.0 (IBM known issue DT474627).","status":"open","published_at":"2026-11-04T21:18:11+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","triaged_at":"2026-11-04T21:50:47+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-04T21:50:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ: XML entity flaw leaks data or crashes Managed File Transfer","impact":"medium","summary":"IBM MQ's Managed File Transfer component does not restrict XML external entity references when processing command queue messages. An authenticated attacker can read sensitive information or cause a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ibm-mq","managed-file-transfer","enterprise-messaging"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive files or crashes the messaging service","analyst_note":"Fixed versions are not stated in the sources; check the IBM security bulletin for CVE-2026-13271 for the patched release per branch.","how_to_check":"- Check the installed IBM MQ version against the affected ranges listed in the description (9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0 through 10.0.0.5 LTS and CD)\n- Confirm whether the Managed File Transfer component is installed on the queue manager","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Teams running IBM MQ with the Managed File Transfer component in the listed version ranges are exposed, since the flaw sits in command queue processing. The attacker must already hold valid credentials. Installations outside the listed ranges, or without Managed File Transfer, are not described as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4253,"output_tokens":613,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions are not stated in the sources; check the IBM security bulletin for CVE-2026-13271 for the patched release per branch.","search":"'-13271':15A,18A '-2026':14A,17A '10.0.0.0':87C '10.0.0.5':89C '9.2.0.0':70C '9.2.0.44':72C '9.3.0.0':74C '9.3.0.42':76C '9.4.0.0':78C,82C '9.4.0.26':80C '9.4.5.1':84C 'allow':97C 'attack':57B,100C 'authent':56B,99C 'caus':63B,106C 'cd':85C,92C 'command':52B,121C 'compon':42B 'could':96C 'crash':9A 'cve':13A,16A 'data':7A 'denial':65B,108C 'due':111C 'enterpris':22B 'enterprise-messag':21B 'entiti':4A,48B,118C 'extern':47B,117C 'file':11A,29B,40B,94C 'flaw':5A 'host':34B 'ibm':1A,19A,25B,36B,68C 'ibm-mq':24B 'improp':113C 'inform':61B,104C 'leak':6A 'lts':73C,77C,81C,90C 'manag':10A,28B,39B,93C 'managed-file-transf':27B 'messag':23B,54B 'mq':2A,20A,26B,37B,69C 'obtain':102C 'packag':31B 'process':51B,123C 'queue':53B,122C 'read':59B 'refer':49B,119C 'restrict':45B,114C 'self':33B 'self-host':32B 'sensit':60B,103C 'servic':67B,110C 'transfer':12A,30B,41B,95C 'xml':3A,46B,116C 'xxe':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ with the Managed File Transfer component in the listed version ranges are exposed, since the flaw sits in command queue processing. The attacker must already hold valid credentials. Installations outside the listed ranges, or without Managed File Transfer, are not described as affected.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:53:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271","run_id":1715},"products":{"at":"2026-11-04T21:53:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271","run_id":1715},"who_affected":{"at":"2026-11-04T21:53:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271","run_id":1715}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmmq","mq"],"ptokens":["ibm","mq"],"labels":["enterprisemessaging","high","ibmmq","managedfiletransfer","package","selfhosted","xxe"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13271","severity":null,"published_at":"2026-11-04T21:18:11+00:00","modified_at":"2026-11-04T21:18:11+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","fetched_at":"2026-11-04T21:49:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13271:1715","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271","severity":null,"published_at":"2026-11-04T21:53:26+00:00","modified_at":"2026-11-04T21:53:26+00:00","first_seen_at":"2026-11-04T21:53:26+00:00","fetched_at":"2026-11-04T21:53:26+00:00","note":"Read IBM bulletin (published 29 Oct 2026): fixes per branch, affected ranges, MFT component. No workaround listed; no exploitation or PoC seen (social search not run). Bulletin title says DoS only, description also says info disclosure.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271"]}],"documents":[{"id":70880,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271","title":"IBM Security Bulletin CVE-2026-13271","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}