EUVD-2026-78155
GHSA-5r5q-97h5-g9v3
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Network-accessible API requires authenticated MFT publish authority (PR:L, AC:H); XXE yields file-read confidentiality and DoS but no integrity impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API.
AnalysisAI
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete conditions must simultaneously be true: (1) the IBM MQ installation includes the MFT (Managed File Transfer) component and the mqweb server is running and network-accessible; (2) the attacker possesses valid IBM MQ credentials authenticated to the queue manager; and (3) those credentials carry specifically the MFT publish authority permission, which is not granted by default to standard MQ users and must be explicitly assigned by an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 6.8 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H accurately reflects a genuinely constrained attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM-provided security fix documented at https://www.ibm.com/support/pages/node/7284895; exact patched version numbers per release train must be confirmed from that advisory, as they were not independently specified in available source data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today