CVE-2026-13287

IBM MQ versions spanning the 9.1 through 10.0 release trains contain an XML external entity (XXE) injection flaw (CWE-611) in the way the product processes XML data. A remote attacker with some level of valid access or privileges (the CVSS vector specifies PR:L) can submit crafted XML containing malicious external entity declarations, which IBM MQ resolves when parsing the data. Successful exploitation lets the attacker read sensitive information such as local files or internal resources, or repeatedly trigger entity expansion to consume memory resources and degrade or disrupt the queue manager (high confidentiality impact, low availability impact). Any organization running the listed IBM MQ LTS or Continuous Delivery (CD) versions — common in banking, finance, government, and other enterprise messaging backbones — is affected. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog, no public proof of concept exists, and no exploitation has been reported to date.

What to do: Apply the fix IBM has released for this CVE by upgrading affected queue managers beyond the listed end-point versions of each 9.1–10.0 LTS/CD stream, prioritizing internet-reachable and multi-tenant deployments. In the interim, restrict which authenticated users and applications can submit XML messages to MQ, and consider disabling or sandboxing DTD/external entity resolution in XML processing paths. Monitor queue manager logs and XML message flows for entities referencing local files or unusual recursive entity structures, which are telltale XXE probing signs.