Executive brief
IBM MQ is an enterprise message queue used to route business-critical messages across applications and systems. The .NET client component contains an XML external entity (XXE) vulnerability in how it parses message headers, allowing authenticated attackers to read sensitive files from the system or disrupt message processing. This could lead to exposure of configuration files, credentials, or service interruptions for applications relying on MQ for message delivery.
Technical details
The vulnerability is an XML external entity (XXE) injection in the .NET client's RFH2 (Rules and Formatting Header v2) message folder parser. The root cause is improper restriction of XML external entity references when parsing RFH2 headers in incoming messages. An authenticated attacker with network access to an MQ queue can craft a malicious message with a specially formed RFH2 folder containing XXE payloads, which the vulnerable .NET client will process and expand, leading to arbitrary file read or denial of service. The attack requires prior authentication to the MQ system and does not require user interaction. Patches are available for all affected versions (9.1.0.38+, 9.2.0.44+, 9.3.0.42+ LTS; 10.0.0.5+ for CD and 10.0 releases).
Affected products
- IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0
Timeline
- 2026-09-15: disclosed
- 2026-09-14: advisory: IBM security bulletin published