IBM MQ MANAGED FILE TRANSFER · CVE-2026-13284 · Infrastructure
FIX → 9.2.0.46 · 9.3.0.43 · 9.4.0.30 · 10.0.0.6 ✓ verified
IBM says the Managed File Transfer component of IBM MQ is vulnerable to XXE (CWE-611) when processing XML data. A remote attacker with low privileges (CVSS PR:L) could read sensitive information or consume memory. Fixed in 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6 and 10.0.1.0.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IBM MQ with the Managed File Transfer component installed, in the affected versions. The attacker needs network reach and low privileges (CVSS PR:L), and the flaw is in XML handling. Installs without MFT, or already on the fixed levels, can skip it.
Not affected if fixed-version, no-mft-component, unknown
Who cares ibm-mq, managed-file-transfer, messaging, xml, xxe
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 9.2.0.46 · 9.3.0.43 · 9.4.0.30 · 10.0.0.6
Move to the fixed level for your stream: 9.2 LTS -> cumulative security update 9.2.0.46; 9.3 LTS -> 9.3.0.43; 9.4 LTS -> fix pack 9.4.0.30; 10.0 LTS -> 10.0.0.6; 9.4 CD and 10.0 CD -> 10.0.1.0. (IBM Known Issue DT474698.)