---
id: "CVE-2026-13271"
kind: "vulnerability"
aliases: ["CVE-2026-13271"]
title: "IBM MQ: XML entity flaw leaks data or crashes Managed File Transfer"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "IBM MQ", "fixed": ["9.2.0.46", "9.3.0.43", "9.4.0.30", "10.0.0.6", "10.0.1.0"], "affected": "9.2.0.0-9.2.0.44 LTS; 9.3.0.0-9.3.0.42 LTS; 9.4.0.0-9.4.0.26 LTS; 9.4.0.0-9.4.5.1 CD; 10.0.0.0-10.0.0.5 LTS and CD (Managed File Transfer component)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise-messaging", "ibm-mq", "managed-file-transfer", "package", "self-hosted", "xxe"]
not_affected_if: ["auth-required", "default-config", "no-managed-file-transfer"]
published_at: "2026-11-04T21:18:11+00:00"
first_seen_at: "2026-11-04T21:49:22+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13271", "first_seen_at": "2026-11-04T21:49:22+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271", "first_seen_at": "2026-11-04T21:53:26+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271"]}]
exploit_sources: []
---

# IBM MQ: XML entity flaw leaks data or crashes Managed File Transfer

IBM MQ's Managed File Transfer component does not restrict XML external entity references when processing command queue messages. An authenticated attacker can read sensitive information or cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM MQ affected 9.2.0.0-9.2.0.44 LTS; 9.3.0.0-9.3.0.42 LTS; 9.4.0.0-9.4.0.26 LTS; 9.4.0.0-9.4.5.1 CD; 10.0.0.0-10.0.0.5 LTS and CD (Managed File Transfer component) fixed 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6, 10.0.1.0

## How to check

Run dspmqver on each MQ host and compare with: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD. Only installs with the Managed File Transfer component are affected; confirm whether that component is installed on the host.

## Fix

Apply per branch: 9.2 LTS cumulative security update 9.2.0.46; 9.3 LTS 9.3.0.43; 9.4 LTS fix pack 9.4.0.30; 10.0 LTS upgrade to 10.0.0.6; 9.4 CD and 10.0 CD upgrade to 10.0.1.0 (IBM known issue DT474627).

## Timeline

- 2026-11-04T21:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13271
- 2026-11-04T21:53:26+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271 — Read IBM bulletin (published 29 Oct 2026): fixes per branch, affected ranges, MFT component. No workaround listed; no exploitation or PoC seen (social search not run). Bulletin title says DoS only, description also says info disclosure.

## Documents

- [advisory] IBM Security Bulletin CVE-2026-13271 https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-denial-service-vulnerability-cve-2026-13271

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_