---
id: "CVE-2026-13284"
kind: "vulnerability"
aliases: ["CVE-2026-13284"]
title: "IBM MQ: XML external entity flaw can expose data or exhaust memory"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM MQ Managed File Transfer", "fixed": ["9.2.0.46", "9.3.0.43", "9.4.0.30", "10.0.0.6", "10.0.1.0"], "affected": "9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-mq", "infrastructure", "managed-file-transfer", "messaging", "xml", "xxe"]
not_affected_if: ["fixed-version", "no-mft-component", "unknown"]
published_at: "2026-11-04T21:18:11+00:00"
first_seen_at: "2026-11-04T21:49:22+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13284", "first_seen_at": "2026-11-04T21:49:22+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284", "first_seen_at": "2026-11-04T21:52:16+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284"]}]
exploit_sources: []
---

# IBM MQ: XML external entity flaw can expose data or exhaust memory

IBM says the Managed File Transfer component of IBM MQ is vulnerable to XXE (CWE-611) when processing XML data. A remote attacker with low privileges (CVSS PR:L) could read sensitive information or consume memory. Fixed in 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6 and 10.0.1.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM MQ Managed File Transfer affected 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD fixed 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6, 10.0.1.0

## How to check

- Only affects installs with the Managed File Transfer component installed; if MFT is not installed you are not covered by this bulletin.
- Check the version with 'dspmqver'. Affected: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD.
- IBM gives no workaround; apply the fix.

## Fix

Move to the fixed level for your stream: 9.2 LTS -> cumulative security update 9.2.0.46; 9.3 LTS -> 9.3.0.43; 9.4 LTS -> fix pack 9.4.0.30; 10.0 LTS -> 10.0.0.6; 9.4 CD and 10.0 CD -> 10.0.1.0. (IBM Known Issue DT474698.)

## Timeline

- 2026-11-04T21:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13284
- 2026-11-04T21:52:16+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284 — Read IBM bulletin (29 Oct 2026): only the Managed File Transfer component is affected; fixes listed per stream. CVSS PR:L implies low-privilege auth. No exploitation/PoC checked beyond bulletin; X/posts not searched (low-profile).

## Documents

- [advisory] IBM Security Bulletin: MQ Managed File Transfer XXE (CVE-2026-13284) https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-vulnerable-xml-external-entity-injection-cve-2026-13284

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_