High priorityDisclosed

Advisory · CVE-2026-13292

Authenticated code execution via IBM MQ transfer request metadata

IBM MQ could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. IBM rates it high at CVSS 8.8.

Advisory published November 4, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-13292
CWE-15
Action timing
Immediate
ELI5

Explain it like I’m five

Transfer requests carry labels that end up as environment settings for the process handling them. An authenticated attacker can write hostile values into those labels, and the system then runs with the attacker's settings.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated access

    An attacker with low-privilege authenticated access to IBM MQ submits a transfer request.

  2. 02Malicious metadata

    The transfer request metadata carries attacker-controlled environment variable values.

  3. 03Injection

    The values are injected into the environment of the process handling the transfer.

  4. 04Code execution

    The attacker-controlled environment leads to arbitrary code execution.

What happened

IBM disclosed CVE-2026-13292 in IBM MQ: versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. IBM rates it high at CVSS 3.1 8.8.

No fixed version is stated in the NVD record, so this advisory does not name one; operators should follow the remediation IBM lists in its support bulletin.

What to do

  1. Inventory IBM MQ deployments across the 9.2, 9.3, 9.4, and 10.0 lines listed above.
  2. Apply the remediation IBM lists in its support bulletin for CVE-2026-13292.
  3. Review which accounts can submit transfer requests and tighten that access while patching is underway.
  4. Review transfer logs for unusual metadata values or unexpected process behavior.
  5. Confirm the deployed version after patching.

Management note

Environment variable injection is a subtle path to code execution because the malicious input travels through ordinary, trusted metadata. Any authenticated MQ user is in scope, so patching matters more than perimeter controls here.