EUVD-2026-78153
GHSA-6fjc-9pf3-r46v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Primary rating from Vendor (us) · only source for this CVE.
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
AnalysisAI
XML external entity (XXE) injection in IBM MQ (9.1, 9.2, 9.3, 9.4 LTS/CD lines and 10.0.0.0) lets a remote attacker who can already authenticate to MQ and get XML content parsed by the product cause the parser to resolve attacker-supplied external entities. Successful exploitation exposes sensitive information readable by the MQ process (high confidentiality impact) and can consume memory resources, degrading availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today