High priorityDisclosed

Advisory · CVE-2026-13271

Authenticated XML external entity flaw in IBM MQ Managed File Transfer

IBM MQ Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing. IBM rates it high at CVSS 8.1.

Advisory published November 4, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-13271
CWE-611
Action timing
Immediate
ELI5

Explain it like I’m five

The transfer system reads XML instructions but lets those instructions point at outside files. An authenticated attacker can slip in a pointer to a sensitive file and get the system to read it out or grind to a halt.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated access

    An attacker with low-privilege authenticated access to IBM MQ reaches Managed File Transfer command queue processing.

  2. 02Crafted XML

    The attacker submits XML containing an external entity reference pointing at a target file or resource.

  3. 03Entity resolved

    The system resolves the external reference instead of rejecting it.

  4. 04Disclosure or denial of service

    The resolved content can expose sensitive information or disrupt the transfer service.

What happened

IBM disclosed CVE-2026-13271 in IBM MQ Managed File Transfer: versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing. IBM rates it high at CVSS 3.1 8.1.

No fixed version is stated in the NVD record, so this advisory does not name one; operators should follow the remediation IBM lists in its support bulletin.

What to do

  1. Inventory IBM MQ Managed File Transfer deployments across the 9.2, 9.3, 9.4, and 10.0 lines listed above.
  2. Apply the remediation IBM lists in its support bulletin for CVE-2026-13271.
  3. Review which accounts can submit command queue messages and tighten that access while patching is underway.
  4. Review logs for XML messages containing external entity references or unusual file access from transfer processes.
  5. Confirm the deployed version after patching.

Management note

This is the quieter member of the day’s IBM MQ batch: no code execution, but a classic route to reading files the attacker should never see from a trusted internal service. Patch it with the rest of the batch rather than triaging it alone.