Skip to main content

Mq EUVDEUVD-2026-78873

| CVE-2026-12666 HIGH
Improper Restriction of XML External Entity Reference (CWE-611)
2026-09-15 ibm GHSA-8mq2-hm2c-3ccx
Denial Of Service Java IBM XXE Mq
8.1
CVSS 3.1 · Vendor: ibm
View

Vulnerability Assessment

Weakness
CWE
CWE-611
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 message headers, letting an authenticated queue user read server-side files or resources and drive the broker and its Java clients into a denial-of-service state. Affected releases span the 9.1.x, 9.2.x, 9.3.x and 9.4.x LTS/CD streams plus 10.0.0.0 Classes for Java, so any environment running the JMS/XMS or Java messaging client against a current broker is in scope. IBM has published a vendor fix and there is no public exploit code or CISA KEV entry identified at time of analysis, but the confidentiality and availability impact are both rated High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N).

Affected VersionsENISA

MQ 9.3.0.0 ≤9.3.5.1 CD
MQ 9.1.0.0 ≤9.1.0.37 LTS
MQ 9.4.0.0 ≤9.4.0.25 LTS
MQ 9.3.0.0 ≤9.3.0.41 LTS
MQ 9.2.0.0 ≤9.2.0.43 LTS
MQ 9.4.0.0 ≤9.4.5.1 CD
MQ 10.0.0.0

Affected Packages

euvd mq no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Mq gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (ibm) PRIMARY 8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

DescriptionCVE.org

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

XML External Entity Injection HIGH

XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Mq

View all
CVE-2026-12351 CRITICAL
9.8 Sep 15

Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deploy
CVE-2026-10027 CRITICAL
9.8 Sep 18

Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds hea
CVE-2022-22489 CRITICAL
9.1 Aug 19

IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh
CVE-2026-11375 HIGH
8.8 Sep 18

IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer ove
CVE-2026-11378 HIGH
8.8 Sep 18

Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a dis
CVE-2026-12728 HIGH
8.8 Sep 15

Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a chann
CVE-2026-10575 HIGH
8.8 Sep 18

Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to ca
CVE-2026-11725 HIGH
8.8 Sep 18

An integer overflow in IBM MQ's MQINQ (inquire object attributes) request processing lets an authenticated remote user c
CVE-2026-10853 HIGH
8.8 Sep 18

IBM MQ queue managers running affected releases can be crashed - and, per IBM, potentially have arbitrary code executed

CVE-2024-31912 HIGH
8.8 Jun 28

IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du
CVE-2026-11729 HIGH
8.5 Sep 15

Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0
CVE-2026-11728 HIGH
8.1 Sep 15

A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 CRITICAL POC
9.8
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
PATCH https://www.ibm.com/support/pages/node/7284939 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-12666

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy