CVE-2026-13265 in IBM
Summary
by MITRE • 09/15/2026
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified affects IBM MQ versions ranging from 9.1.0.0 through 9.4.5.1, including both Long Term Support and Continuous Delivery releases up to version 10.0.0.0. This security flaw resides within the mqweb component of the IBM Message Queue infrastructure, specifically targeting the Managed File Transfer REST API interface. The core technical issue is an XML External Entity injection vulnerability that arises when the application processes untrusted or insufficiently validated input in XML format. By exploiting this weakness, a remote attacker who has already obtained authentication credentials and possesses MFT publish authority can manipulate how the server parses these XML documents. This manipulation allows for the inclusion of external entities defined by the attacker, which the server then resolves during parsing.
From an operational perspective, the impact of this vulnerability is twofold, encompassing both information disclosure and service disruption. The primary risk involves sensitive data exposure. Through carefully crafted XML payloads containing malicious entity references, an authenticated attacker can force the IBM MQ server to make HTTP or file-based requests to arbitrary destinations controlled by the attacker. This mechanism effectively turns the vulnerable application into a proxy, enabling the retrieval of internal network resources that are otherwise inaccessible from the external environment. Consequently, attackers may access configuration files, database credentials, or other confidential data stored on the host system where IBM MQ is deployed.
In addition to information leakage, this vulnerability can be leveraged to cause a denial of service against the affected systems. By crafting XML documents with deeply nested entities or those that trigger excessive resource consumption during parsing, an attacker can exhaust server memory and CPU resources. This activity leads to significant performance degradation or complete unavailability of the MQ services for legitimate users. The requirement for MFT publish authority means that while the attack is not fully remote without prior authentication, it represents a serious insider threat or lateral movement vector if credentials are compromised through other means such as phishing or credential stuffing attacks.
This vulnerability aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference, and falls under MITRE ATT&CK technique T1059, specifically Command Line Interface execution via proxy abuse scenarios where the application is used to pivot into internal networks. To mitigate this risk, organizations must ensure that all affected IBM MQ instances are updated to a version patched against this specific flaw as outlined in official security advisories from IBM. Furthermore, defense-in-depth strategies should be employed, including restricting network access to the mqweb interface and enforcing strict least-privilege principles for user accounts with MFT publish authority. Input validation mechanisms that strictly whitelist allowed XML structures or disable external entity processing entirely within the application configuration are also critical technical controls to prevent exploitation of this class of vulnerability.