{"id":"CVE-2026-12666","state":"PUBLISHED","title":"IBM MQ Java messaging is vulnerable to XML external entity injection","description":"IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.","publishedAt":"2026-09-15T17:08:05.180Z","updatedAt":"2026-09-17T16:22:00.550Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","source":"ibm"},"assigner":"ibm","products":["IBM MQ"],"affected":[{"vendor":"IBM","product":"MQ","versions":[{"version":"9.1.0.0","status":"affected","lessThanOrEqual":"9.1.0.37 LTS","versionType":"semver"},{"version":"9.2.0.0","status":"affected","lessThanOrEqual":"9.2.0.43 LTS","versionType":"semver"},{"version":"9.3.0.0","status":"affected","lessThanOrEqual":"9.3.0.41 LTS","versionType":"semver"},{"version":"9.3.0.0","status":"affected","lessThanOrEqual":"9.3.5.1 CD","versionType":"semver"},{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.4.0.25 LTS","versionType":"semver"},{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.4.5.1 CD","versionType":"semver"},{"version":"10.0.0.0","status":"affected"}],"cpes":["cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.1.0.37:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.2.0.43:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.41:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.25:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.5.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:10.0.0.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7284939"],"weaknesses":["CWE-611"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12666.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12666","state":"PUBLISHED","datePublished":"2026-09-15T17:08:05.180Z","dateUpdated":"2026-09-17T16:22:00.550Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-06-18T19:13:47.535Z"},"containers":{"cna":{"title":"IBM MQ Java messaging is vulnerable to XML external entity injection","descriptions":[{"lang":"en","value":"IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing."}],"affected":[{"vendor":"IBM","product":"MQ","versions":[{"version":"9.1.0.0","status":"affected","lessThanOrEqual":"9.1.0.37 LTS","versionType":"semver"},{"version":"9.2.0.0","status":"affected","lessThanOrEqual":"9.2.0.43 LTS","versionType":"semver"},{"version":"9.3.0.0","status":"affected","lessThanOrEqual":"9.3.0.41 LTS","versionType":"semver"},{"version":"9.3.0.0","status":"affected","lessThanOrEqual":"9.3.5.1 CD","versionType":"semver"},{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.4.0.25 LTS","versionType":"semver"},{"version":"9.4.0.0","status":"affected","lessThanOrEqual":"9.4.5.1 CD","versionType":"semver"},{"version":"10.0.0.0","status":"affected"}],"cpes":["cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.1.0.37:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.2.0.43:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.41:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.25:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.5.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:10.0.0.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7284939","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-611","lang":"en","description":"CWE-611 Improper Restriction of XML External Entity Reference","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-09-15T17:08:05.180Z"},"solutions":[{"lang":"en","value":"This issue was addressed under Known Issue DT474364\n\n\n\nIBM MQ version 9.1 LTS\n\n\n\n Apply cumulative security update 9.1.0.38 https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts \n\n\n\nIBM MQ version 9.2 LTS\n\n\n\n Apply cumulative security update 9.2.0.44 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts \n\n\n\nIBM MQ version 9.3 LTS\n\n\n\n Apply cumulative security update 9.3.0.42 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts \n\n\n\nIBM MQ version 9.4 LTS\n\n\n\n Apply cumulative security update https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts   9.4.0.26 https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts \n\n\n\nIBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0\n\n\n\n Upgrade to IBM MQ version 10.0.0.5 https://www.ibm.com/support/pages/downloading-ibm-mq-100","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>This issue was addressed under Known Issue DT474364</p><p>IBM MQ version 9.1 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update 9.1.0.38</a></p><p>IBM MQ version 9.2 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update 9.2.0.44</a></p><p>IBM MQ version 9.3 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update 9.3.0.42</a></p><p>IBM MQ version 9.4 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update</a><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\" rel=\"noopener noreferrer nofollow\"> 9.4.0.26</a></p><p>IBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-100\" rel=\"noopener noreferrer nofollow\">Upgrade to IBM MQ version 10.0.0.5</a></p>"}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-17T16:21:49.943491Z","id":"CVE-2026-12666","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-17T16:22:00.550Z"}}]}}}