{"id":"CVE-2026-13289","kind":"vulnerability","aliases":["CVE-2026-13289"],"related":[],"title":"IBM MQ: XML external entity flaw lets remote attackers read data","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.","summary":"IBM MQ parses XML data in a way that allows XML external entity injection. A remote attacker can use it to expose sensitive information or consume memory.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","ibm-mq","infrastructure","messaging"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"- Check the installed IBM MQ version against the affected ranges listed in the advisory (9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0 through 10.0.0.5 LTS and CD)\n- Confirm whether the queue manager processes XML messages from untrusted senders: unknown","fix":"- Move to a fixed IBM MQ version as stated by IBM; the sources do not name the fixed release: unknown","status":"open","published_at":"2026-11-04T21:18:12+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","triaged_at":"2026-11-04T21:50:58+00:00","updated_at":"2026-11-04T21:50:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T21:50:58Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed IBM MQ version as stated by IBM; the sources do not name the fixed release: unknown","reach":"network","title":"IBM MQ: XML external entity flaw lets remote attackers read data","impact":"medium","summary":"IBM MQ parses XML data in a way that allows XML external entity injection. A remote attacker can use it to expose sensitive information or consume memory.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-mq","messaging","enterprise"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker reads sensitive server files or exhausts memory","analyst_note":"Check the IBM security bulletin for the fixed versions and the exact XML processing feature that is exposed; the NVD entry does not name them.","how_to_check":"- Check the installed IBM MQ version against the affected ranges listed in the advisory (9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0 through 10.0.0.5 LTS and CD)\n- Confirm whether the queue manager processes XML messages from untrusted senders: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"IBM MQ installations in the listed version ranges are affected. Exposure depends on whether the queue manager parses XML data from senders that an attacker can reach; the sources do not say which configurations are exposed. Systems on versions outside the listed ranges are not covered by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000754,"input_tokens":4257,"output_tokens":657,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-13289':14A,17A '-2026':13A,16A '10.0.0.0':70C '10.0.0.5':72C '9.2.0.0':53C '9.2.0.44':55C '9.3.0.0':57C '9.3.0.42':59C '9.4.0.0':61C,65C '9.4.0.26':63C '9.4.5.1':67C 'allow':33B 'attack':9A,40B,85C,92C 'cd':68C,75C 'consum':49B,102C 'could':93C 'cve':12A,15A 'data':11A,28B,89C 'enterpris':18B 'entiti':5A,36B,82C 'exploit':94C 'expos':45B,98C 'extern':4A,35B,81C 'flaw':6A 'ibm':1A,20B,24B,51C 'ibm-mq':19B 'inform':47B,100C 'infrastructur':22B 'inject':37B,83C 'let':7A 'lts':56C,60C,64C,73C 'memori':50B,103C 'messag':23B 'mq':2A,21B,25B,52C 'pars':26B 'process':87C 'read':10A 'remot':8A,39B,91C 'resourc':104C 'sensit':46B,99C 'use':42B 'vulner':77C,96C 'way':31B 'xml':3A,27B,34B,80C,88C 'xxe':84C","nicknames":[],"mitigations":[],"who_affected":"IBM MQ installations in the listed version ranges are affected. Exposure depends on whether the queue manager parses XML data from senders that an attacker can reach; the sources do not say which configurations are exposed. Systems on versions outside the listed ranges are not covered by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["enterprise","high","ibmmq","infrastructure","messaging"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13289","severity":null,"published_at":"2026-11-04T21:18:12+00:00","modified_at":"2026-11-04T21:18:12+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","fetched_at":"2026-11-04T21:49:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}