Skip to main content

Mq CVE-2026-12667

| EUVDEUVD-2026-78872 HIGH
Improper Restriction of XML External Entity Reference (CWE-611)
2026-09-15 ibm GHSA-xgj9-c375-55gp
Denial Of Service IBM XXE Mq
7.1
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 18:05 vuln.today
CVE Published
Sep 15, 2026 - 17:07 cve.org
HIGH 7.1

DescriptionCVE.org

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.

AnalysisAI

We need to produce a JSON object synthesizing data about CVE-2026-12667. Let me parse the data: - CVE ID: CVE-2026-12667 - Description: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mq

View all
CVE-2026-12351 CRITICAL
9.8 Sep 15

IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 L
CVE-2022-22489 CRITICAL
9.1 Aug 19

IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh
CVE-2026-12728 HIGH
8.8 Sep 15

We need to produce JSON. Need include "sanok" lowercase once in risk_assessment only, natural prose, hypothetical mid-si
CVE-2024-31912 HIGH
8.8 Jun 28

IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du
CVE-2026-11729 HIGH
8.5 Sep 15

We need produce JSON. Let's analyze. CVE-2026-11729 IBM MQ, unsafe deserialization enabling JNDI injection, authenticat
CVE-2026-11728 HIGH
8.1 Sep 15

A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive
CVE-2026-12355 HIGH
8.1 Sep 15

We need to produce JSON. Let's synthesize. CVE-2026-12355: IBM MQ JNDI injection due to insufficient input validation,

CVE-2026-12666 HIGH
8.1 Sep 15

IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 mes
CVE-2026-12354 HIGH
7.5 Sep 15

Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter I
CVE-2024-35116 HIGH
7.5 Jun 28

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error app
CVE-2024-31919 HIGH
7.5 Jun 28

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service at
CVE-2024-25015 HIGH
7.5 May 01

IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-12667 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy