IBM MQ: Managed File Transfer agent arbitrary code execution (CVE-2026-11724)
IBM MQ Managed File Transfer (MFT) contains a vulnerability that could allow an authenticated attacker to execute arbitrary code on an agent host due to improper validation of metadata used during script execution.
CVE search metadata
CVE search record: CVE-2026-11724. Severity: high. CVSS: 8.5. KEV: no. Product: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, IBM MQ 9.3.0.0 through 9.3.0.42 LTS, IBM MQ 9.4.0.0 through 9.4.0.26 LTS, IBM MQ 9.4.0.0 through 9.4.5.1 CD, IBM MQ 10.0.0.0 through 10.0.0.5 LTS and CD. Brief: IBM MQ: Managed File Transfer agent arbitrary code execution (CVE-2026-11724). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-mq-rce/
Triage facts
Revision 1- Applicability
- IBM MQ 9.2.0.0 through 9.2.0.44 LTS, IBM MQ 9.3.0.0 through 9.3.0.42 LTS +3
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 22:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-11724 affects IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD. The vulnerability permits an authenticated attacker to execute arbitrary code on an MFT agent host by exploiting improper metadata validation during script execution.