{"id":"CVE-2026-13292","kind":"vulnerability","aliases":["CVE-2026-13292"],"related":[],"title":"IBM MQ: authenticated users can run code via transfer request metadata","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.","summary":"IBM's bulletin says the Managed File Transfer component of IBM MQ lets an authenticated attacker execute arbitrary code by injecting malicious environment variables through transfer request metadata (CWE-15, CVSS 8.8). IBM fixed it under known issue DT474692. No exploitation or public PoC found in the sources read.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM MQ Managed File Transfer","fixed":["9.2.0.46","9.3.0.43","9.4.0.30","10.0.0.6","10.0.1.0"],"affected":"9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-mq","infrastructure","managed-file-transfer","messaging","self-hosted"],"not_affected_if":["fixed-version","no-authenticated-access","no-managed-file-transfer","unaffected-version"],"how_to_check":"IBM lists only the Managed File Transfer component as affected. Run dspmqver to get the MQ version and compare with the affected ranges: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD. Then check whether the Managed File Transfer component is installed. The bulletin does not say whether it is enabled by default.","fix":"Upgrade: 9.2 LTS to cumulative security update 9.2.0.46; 9.3 LTS to 9.3.0.43; 9.4 LTS to fix pack 9.4.0.30; 10.0 LTS to 10.0.0.6; 9.4 CD and 10.0 CD to 10.0.1.0. IBM lists no workaround.","status":"open","published_at":"2026-11-04T21:18:12+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","triaged_at":"2026-11-04T21:50:31+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-04T21:50:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ: authenticated users can run code via transfer request metadata","impact":"high","summary":"IBM MQ accepts malicious environment variables inside transfer request metadata, which the product does not sanitize. An authenticated attacker can use this to execute arbitrary code on the MQ server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-mq","messaging","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker executes arbitrary code on the MQ server","analyst_note":"Check the IBM security bulletin for the fixed versions and whether the transfer metadata path is enabled by default; the NVD entry alone does not state the fix.","how_to_check":"- Confirm the installed IBM MQ version with `dspmqver` and compare it to the affected ranges in the description: 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0 through 10.0.0.5 LTS and CD.\n- Check whether MQ file transfer features that accept transfer request metadata are in use: unknown whether the sources name a specific configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-access"],"who_is_affected":"Teams running IBM MQ in the listed version ranges are exposed. The attacker needs valid credentials for the MQ system, so exposure depends on who holds accounts. Installations outside the listed ranges are not affected by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4236,"output_tokens":650,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for the fixed versions and whether the transfer metadata path is enabled by default; the NVD entry alone does not state the fix.","search":"'-13292':14A,17A '-15':64B '-2026':13A,16A '10.0.0.0':103C '10.0.0.5':105C '8.8':66B '9.2.0.0':86C '9.2.0.44':88C '9.3.0.0':90C '9.3.0.42':92C '9.4.0.0':94C,98C '9.4.0.26':96C '9.4.5.1':100C 'allow':110C 'arbitrari':52B,116C 'attack':50B,113C 'authent':3A,49B,112C 'bulletin':37B 'cd':101C,108C 'code':7A,53B,117C 'compon':43B 'could':109C 'cve':12A,15A 'cvss':65B 'cwe':63B 'dt474692':73B 'environ':57B,121C 'execut':51B,115C 'exploit':75B 'file':21A,29B,41B 'fix':68B 'found':79B 'host':34B 'ibm':1A,18A,24B,35B,45B,67B,84C 'ibm-mq':23B 'infrastructur':26B 'inject':55B,119C 'issu':72B 'known':71B 'let':47B 'lts':89C,93C,97C,106C 'malici':56B,120C 'manag':28B,40B 'managed':20A 'managed-file-transf':27B 'messag':31B 'metadata':11A,62B,126C 'mq':2A,19A,25B,46B,85C 'poc':78B 'public':77B 'read':83B 'request':10A,61B,125C 'run':6A 'say':38B 'self':33B 'self-host':32B 'sourc':82B 'transfer':9A,22A,30B,42B,60B,124C 'user':4A 'variabl':58B,122C 'via':8A","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ with the Managed File Transfer component installed, in the listed version ranges. The attacker needs valid credentials that can submit transfer requests, so exposure depends on who holds accounts. Installations without Managed File Transfer, or on fixed versions, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:51:27Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292","run_id":1710},"products":{"at":"2026-11-04T21:51:27Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292","run_id":1710},"how_to_check":{"at":"2026-11-04T21:51:27Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292","run_id":1710},"who_affected":{"at":"2026-11-04T21:51:27Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292","run_id":1710}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmmqmanagedfiletransfer","mqmanagedfiletransfer"],"ptokens":["file","ibm","managed","mq","transfer"],"labels":["high","ibmmq","infrastructure","managedfiletransfer","messaging","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13292","severity":null,"published_at":"2026-11-04T21:18:12+00:00","modified_at":"2026-11-04T21:18:12+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","fetched_at":"2026-11-04T21:49:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13292:1710","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292","severity":null,"published_at":"2026-11-04T21:51:27+00:00","modified_at":"2026-11-04T21:51:27+00:00","first_seen_at":"2026-11-04T21:51:27+00:00","fetched_at":"2026-11-04T21:51:27+00:00","note":"Read IBM bulletin (primary): affects MQ Managed File Transfer component only; fixes per stream listed; no workarounds. MFT default enablement not stated by IBM. Did not search social; tier B single pass.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292"]}],"documents":[{"id":70870,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292","title":"IBM Security Bulletin: MQ Managed File Transfer arbitrary code execution (CVE-2026-13292)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}