← CVE Radar
CVE-2026-13292IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.
8.8 HIGHEPSS 0.32%Not in KEVNVD: Undergoing Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1ibm (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-13292
- Status
- Undergoing Analysis
- Assigner (CNA)
- ibm
- Published
- Nov 4, 2026
- Last modified
- 2026-11-06 12:17 UTC
- Weaknesses
- CWE-15 · External Control of System or Configuration Setting
Affected Products
As published by the CNA in the CVE record.
IBMMQ5 version ranges
- 9.2.0.0 through 9.2.0.44
- 9.3.0.0 through 9.3.0.42
- 9.4.0.0 through 9.4.0.26
- 9.4.0.0 through 9.4.5.1
- 10.0.0.0 through 10.0.0.5