high7.1
CVE-2026-12667
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.…
Impact
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.
Affected products
| Product | Affected versions |
|---|---|
| IBM MQ 9.1.0.0 | through 9.1.0.37 |
| LTS, 9.2.0.0 | through 9.2.0.43 |
| LTS, 9.3.0.0 | through 9.3.0.41 through 9.3.5.1 |
| CD, 9.4.0.0 | through 9.4.0.25 |
| LTS, 9.4.0.0 | through 9.4.5.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.