CVE-2026-12667

CVE-2026-12667 is an XML external entity injection (XXE, CWE-611) flaw in the IBM MQ .NET client's parsing of RFH2 message headers, affecting IBM MQ 9.1 LTS through 10.0. An authenticated attacker who can place messages on a queue sends a message whose RFH2 folder XML contains crafted external entity definitions; when a vulnerable .NET client consumes the message and parses the header, the entities are resolved, allowing the attacker to read files accessible to the client process (high confidentiality impact) or trigger entity-expansion-induced denial of service (low availability impact). Exploitation requires valid credentials and the ability to put messages to queues consumed by .NET clients, which limits the attacker pool but is realistic in multi-tenant or partner-connected messaging topologies. Organizations running any listed IBM MQ version with .NET client applications are affected. No public proof-of-concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation status is none known.

What to do: Upgrade all affected IBM MQ installations and, critically, every application embedding the IBM MQ .NET client to the fixed versions specified in IBM's security bulletin for CVE-2026-12667, since the flaw is in client-side RFH2 parsing. Inventory .NET applications that consume MQ messages and verify which client version they bundle. As a mitigation, tightly restrict put authority on queues consumed by .NET clients (the attack requires authenticated message injection) and monitor for messages with unusual RFH2 header content or local file-access anomalies on client hosts.