Executive brief
IBM MQ is a message-oriented middleware platform used to reliably transmit data between applications and systems. The Java messaging component contains an XML parsing vulnerability that allows authenticated attackers to read sensitive files from the server or crash the messaging service, impacting business continuity and data confidentiality.
Technical details
The vulnerability is an XML External Entity (XXE) injection flaw (CWE-611) in the IBM MQ Classes for Java client's RFH2 header parser. The vulnerable component improperly processes XML in MQRFH2 message headers without adequately restricting external entity references. An authenticated attacker with network access to an MQ queue manager can craft malicious messages with XXE payloads to exfiltrate sensitive information (such as configuration files, certificates, or credentials) or cause denial of service through entity expansion attacks. No user interaction is required; authentication to the MQ broker is the sole precondition. Patches are available across all affected versions.
Affected products
- IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0
Timeline
- 2026-09-15: disclosed
- patched: Patches available: 9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26 LTS; 10.0.0.5 for CD versions