Loading vulnerability…
XXE in IBM MQ mqweb MFT REST API
CVE-2026-13265 is an XML external entity (XXE) injection vulnerability in the IBM MQ mqweb Managed File Transfer (MFT) REST API. Affected releases include IBM MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41 and 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25 and 9.4 CD through 9.4.5.1, and IBM MQ 10.0.0.0. The API's XML processing can be induced to resolve external entities by an authenticated principal with MFT publish authority.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information accessible to the mqweb MFT REST API process through external-entity resolution, or cause denial of service through malicious XML entity processing. Integrity impact is not identified.
Patch, then assume compromise.
Apply the IBM MQ security patch published for CVE-2026-13265 on September 14, 2026, following IBM's applicable maintenance guidance for the deployed LTS or CD release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.