---
id: "CVE-2026-13292"
kind: "vulnerability"
aliases: ["CVE-2026-13292"]
title: "IBM MQ: authenticated users can run code via transfer request metadata"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM MQ Managed File Transfer", "fixed": ["9.2.0.46", "9.3.0.43", "9.4.0.30", "10.0.0.6", "10.0.1.0"], "affected": "9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-mq", "infrastructure", "managed-file-transfer", "messaging", "self-hosted"]
not_affected_if: ["fixed-version", "no-authenticated-access", "no-managed-file-transfer", "unaffected-version"]
published_at: "2026-11-04T21:18:12+00:00"
first_seen_at: "2026-11-04T21:49:22+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13292", "first_seen_at": "2026-11-04T21:49:22+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292", "first_seen_at": "2026-11-04T21:51:27+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292"]}]
exploit_sources: []
---

# IBM MQ: authenticated users can run code via transfer request metadata

IBM's bulletin says the Managed File Transfer component of IBM MQ lets an authenticated attacker execute arbitrary code by injecting malicious environment variables through transfer request metadata (CWE-15, CVSS 8.8). IBM fixed it under known issue DT474692. No exploitation or public PoC found in the sources read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM MQ Managed File Transfer affected 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD fixed 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6, 10.0.1.0

## How to check

IBM lists only the Managed File Transfer component as affected. Run dspmqver to get the MQ version and compare with the affected ranges: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS and CD. Then check whether the Managed File Transfer component is installed. The bulletin does not say whether it is enabled by default.

## Fix

Upgrade: 9.2 LTS to cumulative security update 9.2.0.46; 9.3 LTS to 9.3.0.43; 9.4 LTS to fix pack 9.4.0.30; 10.0 LTS to 10.0.0.6; 9.4 CD and 10.0 CD to 10.0.1.0. IBM lists no workaround.

## Timeline

- 2026-11-04T21:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13292
- 2026-11-04T21:51:27+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292 — Read IBM bulletin (primary): affects MQ Managed File Transfer component only; fixes per stream listed; no workarounds. MFT default enablement not stated by IBM. Did not search social; tier B single pass.

## Documents

- [advisory] IBM Security Bulletin: MQ Managed File Transfer arbitrary code execution (CVE-2026-13292) https://www.ibm.com/support/pages/security-bulletin-ibm-mq-managed-file-transfer-affected-arbitrary-code-execution-vulnerability-cve-2026-13292

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_