{"id":"CVE-2026-13284","aliases":[],"cve":{"records":[{"id":"CVE-2026-13284","source":"ibm","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-24T21:53:47.245Z","published":"2026-11-04T20:25:12.162Z","modified":"2026-11-09T20:51:49.594Z"}],"publishers":[{"name":"ibm","role":"CNA","organizationId":"9a959283-ebb5-44b6-b705-dcc2bbced522","modified":"2026-11-04T20:25:12.162Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T20:51:49.594Z"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7294500","tags":["vendor-advisory","patch"],"source":"ibm"}],"weaknesses":[{"id":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","source":"ibm"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T20:51:23.495973Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"IBM MQ Managed File Transfer is vulnerable to XML external entity injection","titleSource":"ibm","descriptionSource":"ibm","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.","score":7.1,"severity":"high","published":"2026-11-04T20:25:12.162Z","modified":"2026-11-09T20:51:49.594Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"IBM","name":"MQ","platforms":[],"versions":[{"version":"9.2.0.0","status":"affected","lessThanOrEqual":"9.2.0.44","versionType":"semver"},{"version":"9.3.0.0","status":"affected","lessThanOrEqual":"9.3.0.42","versionType":"semver"},{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.4.0.26","versionType":"semver"},{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.4.5.1","versionType":"semver"},{"version":"10.0.0.0","status":"affected","lessThanOrEqual":"10.0.0.5","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*"],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-13284"}],"remediation":[{"text":"This issue was addressed under Known Issue DT474698.\n\n\n\nIBM MQ version 9.2 LTS\n\n\n\n Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts \n\n\n\nIBM MQ version 9.3 LTS\n\n\n\n Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts \n\n\n\nIBM MQ version 9.4 LTS\n\n\n\n Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94 \n\n\n\nIBM MQ version 10.0.LTS\n\n\n\n Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100 \n\n\n\nIBM MQ version 9.4 CD and 10.0 CD\n\n\n\n Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-13284"}],"references":["https://www.ibm.com/support/pages/node/7294500"],"sources":[{"name":"CVE","id":"CVE-2026-13284","modified":"2026-11-09T20:51:49.594Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-13284"}],"assessments":[{"source":"ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","score":7.1}],"sourceAffected":[],"observedAt":"2026-11-09T21:00:48.203Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:00:33.565Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T10:20:32.726Z","attemptedAt":"2026-11-05T10:20:32.726Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-05T10:25:33.452Z","attemptedAt":"2026-11-05T10:25:33.452Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-05T10:25:33.935Z","attemptedAt":"2026-11-05T10:25:33.935Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T10:20:32.418Z","attemptedAt":"2026-11-05T10:20:32.418Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-13284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13284","modified":"2026-11-04T21:18:12.077","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","checkedAt":"2026-11-05T10:20:32.726Z"},{"source":"GitHub Advisory Database","id":"GHSA-pj8c-6jhv-qc67","url":"https://github.com/advisories/GHSA-pj8c-6jhv-qc67","modified":"2026-11-04T21:32:40Z","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","checkedAt":"2026-11-05T10:25:33.452Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117069","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117069","modified":"Nov 4, 2026, 8:25:12 PM","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","checkedAt":"2026-11-05T10:25:33.935Z"}],"aiSummary":{"text":"IBM MQ versions 9.2.0.0 through 9.2.0.44, 9.3.0.0 through 9.3.0.42, 9.4.0.0 through 9.4.0.26, 9.4.0.0 through 9.4.5.1, and 10.0.0.0 through 10.0.0.5 are vulnerable to XML external entity injection. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T21:26:10.171Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-13284"}]}}