EUVD-2026-78154
GHSA-47qx-f7xv-mh34
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-reachable parser flaw but requires a valid low-privileged MQ credential (PR:L); AC:L since no special timing or interaction is needed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.
AnalysisAI
An XML external entity (XXE) injection flaw in IBM MQ's reply-message processing lets an authenticated attacker who can place messages on a queue cause the broker to resolve externally defined entities, resulting in arbitrary file disclosure from the MQ server and server-side request forgery against internal networks. The issue spans a wide swath of supported releases - MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41 and 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25 and 9.4 CD through 9.4.5.1, plus MQ 10.0.0.0 Managed File Transfer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a valid authenticated identity on the queue manager with permission to send messages that reach reply-message processing - typically put authority on the relevant queue or an application that replies to inbound messages, and (2) the ability to supply XML content containing a DOCTYPE/external entity, meaning the deployment must actually route XML-formatted payloads through the affected path rather than, say, binary JMS or MQSTR bodies with no XML parsing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are reasonably consistent: CVSS 7.1 with network vector, low complexity, no user interaction and PR:L means a valid, low-privileged messaging credential is the only barrier, and no EPSS or KEV data was supplied, so there is no evidence of active exploitation or public exploit code. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed maintenance level IBM documents in its security bulletin at https://www.ibm.com/support/pages/node/7284897 - in practice that means upgrading to a release above the affected ranges listed above (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today