IBM MQ Managed File Transfer suffers from improper restriction of XML external entity references in command queue processing, enabling an authenticated attacker to cause a denial of service or to obtain sensitive information. The flaw is classified as CWE-611.

IBM MQ 9.2 LTS versions 9.2.0.0 through 9.2.0.44, IBM MQ 9.3 LTS 9.3.0.0 through 9.3.0.42, IBM MQ 9.4 LTS 9.4.0.0 through 9.4.0.26, IBM MQ 9.4 CD 9.4.0.0 through 9.4.5.1, and IBM MQ 10.0 LTS and CD 10.0.0.0 through 10.0.0.5, all of which are affected by the XML external entity processing issue in Managed File Transfer.

The CVSS score of 8.1 indicates high severity, but the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, showing no documented public exploitation. An attacker must be authenticated and able to submit XML payloads to a command queue; the flaw can lead to resource exhaustion or data exposure within the scope of Managed File Transfer.