CVE-2026-1713: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-1713 is an authentication bypass vulnerability (CWE-305) in IBM MQ that allows a low-privileged local user to modify or tamper with MQ data and configurations when user interaction is present. It affects IBM MQ versions 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD. The vulnerability was published on March 3, 2026, with a patch made available shortly after. It carries a CVSS v3.1 base score of 5.0 (Medium) (IBM Support, Red Hat CVE).

The vulnerability is classified as CWE-305 (Authentication Bypass by Primary Weakness), meaning a secondary authentication or authorization control can be circumvented due to a weakness in a primary mechanism. The attack vector is local, requiring low privileges and user interaction, with low attack complexity. A local attacker with limited privileges can exploit this flaw to bypass authentication controls within IBM MQ, enabling unauthorized modification of messaging data and system configurations. No public technical write-ups or proof-of-concept code have been identified at this time (IBM Support, Red Hat CVE).

Successful exploitation of CVE-2026-1713 allows a low-privileged local attacker to compromise the integrity of IBM MQ messaging data and configurations, potentially disrupting message routing, altering queue configurations, or injecting malicious messages into business-critical workflows. Confidentiality and availability are not impacted by this vulnerability. The scope is limited to the affected MQ instance, but integrity compromise of a messaging backbone could have downstream effects on dependent applications and services (IBM Support).

IBM has released patched versions addressing CVE-2026-1713. Organizations should upgrade to one of the following fixed releases based on their deployment track: IBM MQ 9.1.0.34 LTS or later, 9.2.0.41 LTS or later, 9.3.0.37 LTS or later, 9.4.0.20 LTS or later, or 9.4.5.0 CD or later. As interim measures, apply the principle of least privilege to restrict local system access, limit user interactions with MQ systems to authorized personnel, and monitor MQ systems for unauthorized configuration or data modifications (IBM Support).