CVE-2026-12667

published 2026-09-15

CVE-2026-12667: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS…

Priority P3 40 high 7.1 CVSS 3.1

AV N AC L PR L UI N S U C H I N A L

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
ibm	mq	—	—
ibm	mq	9.1.0.0 – 9.1.0.37 LTS	—
ibm	mq	9.2.0.0 – 9.2.0.43 LTS	—
ibm	mq	9.3.0.0 – 9.3.0.41 LTS	—
ibm	mq	9.4.0.0 – 9.4.0.25 LTS	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611