{"id":"CVE-2026-13284","kind":"vulnerability","aliases":["CVE-2026-13284"],"related":[],"title":"IBM MQ: XML external entity flaw can expose data or exhaust memory","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.","summary":"IBM says the Managed File Transfer component of IBM MQ is vulnerable to XXE (CWE-611) when processing XML data. A remote attacker with low privileges (CVSS PR:L) could read sensitive information or consume memory. Fixed in 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6 and 10.0.1.0.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM MQ Managed File Transfer","fixed":["9.2.0.46","9.3.0.43","9.4.0.30","10.0.0.6","10.0.1.0"],"affected":"9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-mq","infrastructure","managed-file-transfer","messaging","xml","xxe"],"not_affected_if":["fixed-version","no-mft-component","unknown"],"how_to_check":"- Only affects installs with the Managed File Transfer component installed; if MFT is not installed you are not covered by this bulletin.\n- Check the version with 'dspmqver'. Affected: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD.\n- IBM gives no workaround; apply the fix.","fix":"Move to the fixed level for your stream: 9.2 LTS -> cumulative security update 9.2.0.46; 9.3 LTS -> 9.3.0.43; 9.4 LTS -> fix pack 9.4.0.30; 10.0 LTS -> 10.0.0.6; 9.4 CD and 10.0 CD -> 10.0.1.0. (IBM Known Issue DT474698.)","status":"open","published_at":"2026-11-04T21:18:11+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","triaged_at":"2026-11-04T21:50:58+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-04T21:50:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ: XML external entity flaw can expose data or exhaust memory","impact":"medium","summary":"IBM MQ mishandles XML input, allowing XML external entity injection. A remote attacker can read sensitive information or consume server memory.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-mq","messaging","xml"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker reads sensitive data or exhausts server memory","analyst_note":"Find the IBM security bulletin for CVE-2026-13284 to confirm fixed versions, XML trigger conditions and whether the flaw needs authentication.","how_to_check":"- Check the installed IBM MQ version against the affected ranges (9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0 through 10.0.0.5 LTS and CD)\n- Confirm whether the deployment processes XML data, which the sources do not specify further","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"IBM MQ installations in the listed version ranges that process XML data are described as exposed. The sources do not say which XML processing paths or configurations are required to trigger the flaw, so teams should confirm whether their queue managers handle XML messages.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000725,"input_tokens":4257,"output_tokens":599,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-13284 to confirm fixed versions, XML trigger conditions and whether the flaw needs authentication.","search":"'-13284':15A,18A '-2026':14A,17A '-611':50B '10.0.0.0':98C '10.0.0.5':100C '10.0.0.6':76B '10.0.1.0':78B '9.2.0.0':81C '9.2.0.44':83C '9.2.0.46':73B '9.3.0.0':85C '9.3.0.42':87C '9.3.0.43':74B '9.4.0.0':89C,93C '9.4.0.26':91C '9.4.0.30':75B '9.4.5.1':95C 'attack':57B,113C,120C 'cd':96C,103C 'compon':41B 'consum':69B,130C 'could':64B,121C 'cve':13A,16A 'cvss':61B 'cwe':49B 'data':9A,54B,117C 'entiti':5A,110C 'exhaust':11A 'exploit':122C 'expos':8A,126C 'extern':4A,109C 'file':22A,30B,39B 'fix':71B 'flaw':6A 'ibm':1A,19A,25B,35B,43B,79C 'ibm-mq':24B 'inform':67B,128C 'infrastructur':27B 'inject':111C 'l':63B 'low':59B 'lts':84C,88C,92C,101C 'manag':29B,38B 'managed':21A 'managed-file-transf':28B 'memori':12A,70B,131C 'messag':32B 'mq':2A,20A,26B,44B,80C 'pr':62B 'privileg':60B 'process':52B,115C 'read':65B 'remot':56B,119C 'resourc':132C 'say':36B 'sensit':66B,127C 'transfer':23A,31B,40B 'vulner':46B,105C,124C 'xml':3A,33B,53B,108C,116C 'xxe':34B,48B,112C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ with the Managed File Transfer component installed, in the affected versions. The attacker needs network reach and low privileges (CVSS PR:L), and the flaw is in XML handling. Installs without MFT, or already on the fixed levels, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:52:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284","run_id":1714},"products":{"at":"2026-11-04T21:52:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284","run_id":1714},"how_to_check":{"at":"2026-11-04T21:52:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284","run_id":1714},"who_affected":{"at":"2026-11-04T21:52:16Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284","run_id":1714}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmmqmanagedfiletransfer","mqmanagedfiletransfer"],"ptokens":["file","ibm","managed","mq","transfer"],"labels":["high","ibmmq","infrastructure","managedfiletransfer","messaging","xml","xxe"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13284","severity":null,"published_at":"2026-11-04T21:18:11+00:00","modified_at":"2026-11-04T21:18:12+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","fetched_at":"2026-11-04T21:49:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13284:1714","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284","severity":null,"published_at":"2026-11-04T21:52:16+00:00","modified_at":"2026-11-04T21:52:16+00:00","first_seen_at":"2026-11-04T21:52:16+00:00","fetched_at":"2026-11-04T21:52:16+00:00","note":"Read IBM bulletin (29 Oct 2026): only the Managed File Transfer component is affected; fixes listed per stream. CVSS PR:L implies low-privilege auth. No exploitation/PoC checked beyond bulletin; X/posts not searched (low-profile).","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284"]}],"documents":[{"id":70873,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284","title":"IBM Security Bulletin: MQ Managed File Transfer XXE (CVE-2026-13284)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}