High priorityDisclosed

Advisory · CVE-2026-11724

Authenticated code execution on IBM MQ Managed File Transfer agent hosts

IBM MQ Managed File Transfer could allow an authenticated attacker to execute arbitrary code on an agent host due to improper validation of metadata used during script execution. IBM rates it high at CVSS 8.5.

Advisory published November 4, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-11724
CWE-20
Action timing
Immediate
ELI5

Explain it like I’m five

The file transfer agent runs scripts using labels attached to each transfer, but it does not check those labels properly. An authenticated attacker can put hostile instructions in a label and get the agent host to run them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated access

    An attacker with low-privilege authenticated access to IBM MQ reaches the Managed File Transfer components.

  2. 02Malicious metadata

    The attacker submits a transfer whose metadata carries attacker-controlled content.

  3. 03Unchecked script execution

    During script execution, the agent uses the metadata without proper validation.

  4. 04Code execution on the agent host

    The attacker-controlled content executes as code on the Managed File Transfer agent host.

What happened

IBM disclosed CVE-2026-11724 in IBM MQ: versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution. IBM rates it high at CVSS 3.1 8.5.

No fixed version is stated in the NVD record, so this advisory does not name one; operators should follow the remediation IBM lists in its support bulletin.

What to do

  1. Inventory IBM MQ Managed File Transfer agents across the 9.2, 9.3, 9.4, and 10.0 lines listed above.
  2. Apply the remediation IBM lists in its support bulletin for CVE-2026-11724.
  3. Review which accounts can submit transfers and tighten that access while patching is underway.
  4. Review transfer and agent logs for unusual metadata values or unexpected script activity.
  5. Confirm the deployed version after patching.

Management note

File transfer agents often run with access to sensitive data flows, so code execution on an agent host is a foothold into the surrounding file infrastructure, not just the queue. Patch alongside the other IBM MQ issues disclosed the same day.