← CVE Radar
CVE-2026-11724IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
8.5 HIGHEPSS 0.28%Not in KEVNVD: Undergoing Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.5 | HIGH | 3.1ibm (CNA) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-11724
- Status
- Undergoing Analysis
- Assigner (CNA)
- ibm
- Published
- Nov 4, 2026
- Last modified
- 2026-11-06 12:17 UTC
- Weaknesses
- CWE-20 · Improper Input Validation
Affected Products
As published by the CNA in the CVE record.
IBMMQ5 version ranges
- 9.2.0.0 through 9.2.0.44
- 9.3.0.0 through 9.3.0.42
- 9.4.0.0 through 9.4.0.26
- 9.4.0.0 through 9.4.5.1
- 10.0.0.0 through 10.0.0.5