Description
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Published: 2026-11-04
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from improper validation of metadata used during script execution in IBM MQ's Managed File Transfer, permitting an authenticated attacker to run arbitrary code on the agent host. This allows full compromise of that host, jeopardizing confidentiality, integrity, and availability of data handled by the transfer service.

Affected Systems

Affected systems include IBM MQ products. Versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 Community Edition, and 10.0.0.0 through 10.0.0.5 LTS and CD.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity, and while EPSS is not available, no listing in CISA KEV shows it has not yet been widely exploited. The requirement for authentication means that an attacker with valid credentials or who can compromise credentials presents a serious threat.

Generated by OpenCVE AI on November 4, 2026 at 21:23 UTC.

Remediation

Vendor Solution

This issue was addressed under Known Issue DT473347. IBM MQ version 9.2 LTS Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts IBM MQ version 9.3 LTS Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts IBM MQ version 9.4 LTS Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94 IBM MQ version 10.0.LTS Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100 IBM MQ version 9.4 CD and 10.0 CD Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

OpenCVE Recommended Actions

  • Apply cumulative security update 9.2.0.46 for IBM MQ 9.2 LTS
  • Apply cumulative security update 9.3.0.43 for IBM MQ 9.3 LTS
  • Apply fix pack 9.4.0.30 for IBM MQ 9.4 LTS
  • Upgrade to IBM MQ version 10.0.0.6 for IBM MQ 10.0 LTS
  • Upgrade to IBM MQ version 10.0.1.0 for IBM MQ 9.4 CD and 10.0 CD

Generated by OpenCVE AI on November 4, 2026 at 21:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.
Title IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
First Time appeared Ibm
Ibm mq
Weaknesses CWE-20
CPEs cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm mq
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Mq
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-04T20:25:58.419Z

Reserved: 2026-06-09T02:15:39.708Z

Link: CVE-2026-11724

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-04T21:17:56.573

Modified: 2026-11-04T21:17:56.707

Link: CVE-2026-11724

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T21:30:09Z

Weaknesses
  • CWE-20

    Improper Input Validation