IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
"}],"value":"IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-18T19:18:39.915Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7284940"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"This issue was addressed under Known Issue DT474696
IBM MQ version 9.1 LTS
Apply cumulative security update 9.1.0.38
IBM MQ version 9.2 LTS
Apply cumulative security update 9.2.0.44
IBM MQ version 9.3 LTS
Apply cumulative security update 9.3.0.42
IBM MQ version 9.4 LTS
Apply cumulative security update 9.4.0.26
IBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0
"}],"value":"This issue was addressed under Known Issue DT474696\n\n\n\nIBM MQ version 9.1 LTS\n\n\n\n Apply cumulative security update 9.1.0.38 https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts \n\n\n\nIBM MQ version 9.2 LTS\n\n\n\n Apply cumulative security update 9.2.0.44 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts \n\n\n\nIBM MQ version 9.3 LTS\n\n\n\n Apply cumulative security update 9.3.0.42 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts \n\n\n\nIBM MQ version 9.4 LTS\n\n\n\n Apply cumulative security update https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts 9.4.0.26 https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts \n\n\n\nIBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0\n\n\n\n Upgrade to IBM MQ version 10.0.0.5 https://www.ibm.com/support/pages/downloading-ibm-mq-100"}],"title":"IBM MQ Managed File Transfer is vulnerable to XML external entity injection"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-13285","datePublished":"2026-09-14T21:08:29.740Z","dateReserved":"2026-06-24T21:53:48.204Z","dateUpdated":"2026-09-18T19:18:39.915Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-14 21:17:01","lastModifiedDate":"2026-09-18 20:17:05","problem_types":["CWE-611","CWE-611 CWE-611 Improper Restriction of XML External Entity Reference"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-15T13:29:53.049779Z","id":"CVE-2026-13285","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"13285","Ordinal":"1","Title":"IBM MQ Managed File Transfer is vulnerable to XML external entit","CVE":"CVE-2026-13285","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"13285","Ordinal":"1","NoteData":"IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.","Type":"Description","Title":"IBM MQ Managed File Transfer is vulnerable to XML external entit"}]}}}