CVE-2026-13275

IBM MQ Managed File Transfer contains an XML external entity injection (XXE, CWE-611) flaw in its reply message processing, affecting releases from 9.1 through 10.0.0.0 across the LTS and CD streams. An authenticated attacker can send a crafted XML reply message containing malicious external entity definitions; when the MFT component parses it, the referenced entities are resolved, allowing the attacker to read arbitrary files on the server or issue server-side requests to internal resources (SSRF). Successful exploitation requires valid MQ credentials (attack complexity low, privileges low), and the flaw carries a CVSS 3.1 base score of 7.1 (high), with high confidentiality impact and low integrity impact. Organizations running IBM MQ with the Managed File Transfer capability enabled in any of the listed version ranges are affected. There is no known public proof of concept and the CVE is not on the CISA KEV list, indicating no confirmed in-the-wild exploitation at this time.

What to do: Apply IBM's fixed fix packs or releases for your stream (9.1, 9.2, 9.3 LTS/CD, 9.4 LTS/CD, or 10.0) as specified in the IBM advisory, prioritizing any MFT-enabled queue managers reachable by less-trusted users. Restrict which authenticated principals can submit MFT transfer/reply messages, and review MQ and host logs for anomalous reply messages, unexpected local file access, or outbound connections from the MQ server consistent with SSRF probing.