IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

IBM MQ2026-11-04 21:18 UTC1 min readRead in

Summary

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.

Remediation

Inventory every IBM MQ deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Patchhttps://www.ibm.com/support/pages/node/7294641

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
9.2.0.0 – 9.2.0.44	None yet
9.3.0.0 – 9.3.0.42	None yet
9.4.0.0 – 9.4.0.26	None yet
9.4.0.0 – 9.4.5.1	None yet
10.0.0.0 – 10.0.0.5	None yet

Weakness

CWE-15

Timeline

2026-11-04Publicly disclosed

Sources

NVD · CVE