CVE-2026-13289 · Infrastructure
NO FIX YET · SEE WHAT TO DO
IBM MQ parses XML data in a way that allows XML external entity injection. A remote attacker can use it to expose sensitive information or consume memory.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
IBM MQ installations in the listed version ranges are affected. Exposure depends on whether the queue manager parses XML data from senders that an attacker can reach; the sources do not say which configurations are exposed. Systems on versions outside the listed ranges are not covered by this entry.
Not affected if version-outside-listed-ranges
Who cares enterprise, ibm-mq, messaging
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.