CVE-2026-13275 in IBM
Summary
by MITRE • 09/14/2026
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified affects IBM MQ versions ranging from 9.1.0.0 through 9.4.5.1 and Managed File Transfer version 10.0.0.0, specifically within the logic that processes incoming reply messages. This flaw stems from an improper neutralization of special elements used in XML, commonly known as XML External Entity injection or XXE. In these affected versions, the message processing engine fails to adequately restrict or validate external entity references contained within the XML payload of a reply message. When such a maliciously crafted XML document is processed by the IBM MQ server, the underlying XML parser interprets and resolves the external entities without sufficient security controls, allowing an attacker who has valid authentication credentials for the queue manager to exploit this behavior.
The technical mechanism behind this vulnerability relies on the capabilities of standard XML parsers which support the inclusion of external resources via Entity Definitions. By injecting specific entity declarations into the XML structure, an authenticated user can force the server to perform actions that were not intended by the application logic. This primarily manifests in two distinct attack vectors: arbitrary file read and Server-Side Request Forgery. In the case of arbitrary file reading, the attacker constructs a payload containing an external entity reference pointing to local system paths such as /etc/passwd on Linux or C:\Windows\System32\drivers\etc\hosts on Windows. When the server processes this message, it attempts to load and parse these files, potentially returning their contents in error messages or subsequent responses depending on how the application handles parsing failures or successes.
The second major impact vector is Server-Side Request Forgery, often referred to as SSRF when combined with XXE techniques like blind out-of-band data exfiltration. By directing the external entity resolution toward internal network addresses that are not accessible from the public internet, an attacker can leverage IBM MQ as a proxy or pivot point. This allows the attacker to scan internal networks, access sensitive administrative interfaces, or interact with cloud metadata services such as those found in AWS EC2 instances at 169.254.169.254. The ability to initiate requests from the server itself bypasses network perimeter defenses that typically restrict direct external access to these internal resources, thereby expanding the blast radius of a compromised account significantly beyond just data theft within the local file system.
From an operational perspective, this vulnerability poses a severe risk because it requires only authenticated access rather than full administrative privileges or unauthenticated remote code execution. An attacker with basic queue manager permissions can exploit this flaw to exfiltrate sensitive configuration files, database credentials stored in plaintext on disk, internal network topology information, and potentially escalate their position within the infrastructure by accessing backend services that trust connections originating from the MQ server. The impact is compounded by the fact that IBM MQ is frequently deployed as a critical middleware component handling high-value business transactions, making any compromise of its integrity or confidentiality particularly damaging to organizational security postures.
To mitigate this vulnerability, organizations must immediately apply the latest available patches for their specific version line of IBM MQ and Managed File Transfer. For those unable to patch immediately due to operational constraints, strict input validation should be implemented at the application layer if possible, ensuring that XML payloads are sanitized before reaching the queue manager. Additionally, network segmentation strategies can help limit the impact of SSRF attacks by restricting outbound traffic from MQ servers to only necessary destinations and blocking access to internal metadata endpoints or sensitive backend services via firewall rules. It is also recommended to review and restrict user permissions within IBM MQ to adhere to the principle of least privilege, ensuring that users with write access do not necessarily have unnecessary read privileges on system files or unrestricted network egress capabilities.
This vulnerability aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference, a common flaw in systems processing untrusted XML data without disabling external entity resolution. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques T1059.007 for Command and Scripting Interpreter via XML parsing artifacts and potentially T1048 if used for exfiltration over alternative protocols like DNS or HTTP out-of-band channels. Security teams should treat this as a high-severity issue requiring immediate remediation through version upgrades, coupled with enhanced monitoring of MQ logs for anomalous message patterns that may indicate attempted exploitation attempts by malicious insiders or compromised accounts.