CVE-2026-13265: IBM MQ XXE Vulnerability

CVE-2026-13265 Overview

CVE-2026-13265 is an XML External Entity (XXE) injection vulnerability [CWE-611] in the IBM MQ mqweb Managed File Transfer (MFT) REST API. An authenticated attacker holding MFT publish authority can submit crafted XML input that references external entities. Successful exploitation allows the attacker to read sensitive information from the server or trigger a denial of service against the MQ web component.

The issue affects multiple Long Term Support (LTS) and Continuous Delivery (CD) release trains, including IBM MQ 9.1, 9.2, 9.3, 9.4, and 10.0.

Critical Impact
An authenticated user with MFT publish authority can read arbitrary server-accessible files and exhaust MQ web resources through crafted XML payloads.

Affected Products

IBM MQ 9.1.0.0 through 9.1.0.37 LTS and 9.2.0.0 through 9.2.0.43 LTS
IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, and 9.4.0.0 through 9.4.5.1 CD
IBM MQ 10.0.0.0

Discovery Timeline

2026-09-14 - CVE-2026-13265 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-13265

Vulnerability Analysis

The mqweb MFT REST API parses XML input without disabling external entity resolution. When an authenticated user submits a request containing an XML payload, the parser resolves DOCTYPE and ENTITY declarations against local or remote resources. This behavior allows attackers to include the contents of server-side files inside API responses or to redirect the parser to slow or recursive resources, causing resource exhaustion.

Exploitation requires authentication and the MFT publish authority role. The attack surface is limited to users already provisioned within the queue manager's MFT security model, which raises the attack complexity but does not remove the risk from insider threats or compromised service accounts.

Root Cause

The root cause is insecure XML parser configuration in the MFT REST endpoint hosted by mqweb. The parser accepts DTD processing and external entity resolution by default, which conflicts with OWASP guidance for XML processing in web-facing APIs. CWE-611 covers this class of improper restriction of XML external entity references.

Attack Vector

The attacker authenticates to mqweb and submits a POST or PUT request to an MFT REST endpoint containing an XML document with an external entity declaration. The entity references a local file such as a configuration file or a network resource. The parser dereferences the entity, and the resulting content is either reflected in the response, exfiltrated out-of-band, or used to stall the parsing thread for denial of service.

No public proof-of-concept exploit is available. Refer to the IBM Support Article for vendor technical details.

Detection Methods for CVE-2026-13265

Indicators of Compromise

Requests to mqweb MFT REST endpoints containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations in the XML body
Outbound network connections from the MQ web server to unexpected external hosts during REST API request processing
MFT REST responses containing file contents such as /etc/passwd, qm.ini, or other queue manager configuration data
Elevated CPU or memory consumption on the mqweb process during XML parsing

Detection Strategies

Enable HTTP request logging on mqweb and inspect POST and PUT bodies for XML DTD and entity syntax
Correlate authentication events for MFT publish users with anomalous REST API request volumes or payload sizes
Alert on the MQ web JVM process opening unexpected outbound sockets or reading files outside the MQ installation path

Monitoring Recommendations

Forward mqweb access and error logs to a centralized SIEM for continuous review
Baseline normal MFT REST API traffic patterns and alert on deviations in request structure or frequency
Track filesystem reads by the MQ web server process and flag access to sensitive OS or application configuration files

How to Mitigate CVE-2026-13265

Immediate Actions Required

Apply the fixes referenced in the IBM Support Article to all affected LTS and CD release trains
Audit MFT security roles and revoke publish authority from accounts that do not require it
Restrict network access to the mqweb server so that only trusted management hosts can reach the REST API

Patch Information

IBM has published remediation guidance for the affected IBM MQ 9.1, 9.2, 9.3, 9.4, and 10.0 release streams. Consult the vendor advisory for the specific interim fix or fix pack that corresponds to your deployed version and channel.

Workarounds

Place a reverse proxy or Web Application Firewall in front of mqweb to strip or reject XML request bodies containing DOCTYPE or external entity declarations
Limit MFT publish authority to a minimal set of service accounts and rotate their credentials
Disable the MFT REST API on mqweb if the workflow does not require it, until the patch is applied

bash

# Example WAF rule concept: block XML payloads with DOCTYPE declarations
# Pseudocode - adapt to your WAF syntax (ModSecurity, AWS WAF, etc.)
SecRule REQUEST_URI "@beginsWith /ibmmq/rest/v2/mft" \
  "chain,deny,status:400,id:1026013265,msg:'Block XXE in MQ MFT REST API'"
  SecRule REQUEST_BODY "@rx (?i)<!DOCTYPE|<!ENTITY|SYSTEM\s+\"" "t:none"