IBM MQ versions 9.2.x through 10.0.x expose a flaw that allows an authenticated user with command queue access to inject malicious arguments into Ant script commands, causing execution of arbitrary code on the host. The vulnerability is a form of input manipulation (CWE-74) that bypasses safety checks and permits attackers to run commands with the privileges of the MQ process.

Affected by this vulnerability are IBM MQ 9.2 LTS (versions 9.2.0.0 through 9.2.0.44), 9.3 LTS (versions 9.3.0.0 through 9.3.0.42), 9.4 LTS (versions 9.4.0.0 through 9.4.0.26), 9.4 CD and 10.0 CD (versions 9.4.0.0 through 9.4.5.1 and 10.0.0.0 through 10.0.0.5) and 10.0 LTS (versions 10.0.0.0 through 10.0.0.5). All these releases can be fixed with the updates listed in the solution section.

The CVSS score of 7.5 classifies the flaw as high severity. The EPSS score is not available, so exploitation likelihood remains unknown. The vulnerability is not listed in CISA's KEV catalog. It requires an authenticated MQ account with command queue rights to be exploited, limiting the attack surface. The risk is high in environments where MQ command queue access is not tightly controlled.