IBM MQ processes XML data in its Managed File Transfer component. The XML external entity injection flaw allows a remote attacker to embed external entity declarations in a crafted XML message, causing the MQ server to read arbitrary files, access other network resources, or consume excess memory. Based on the description, it is inferred that such exploits could expose sensitive configuration or communication files and, if repeated, could lead to service disruption through memory exhaustion.

IBM MQ versions 9.2.0.0 to 9.2.0.44 LTS, 9.3.0.0 to 9.3.0.42 LTS, 9.4.0.0 to 9.4.0.26 LTS, 9.4.0.0 to 9.4.5.1 CD, and 10.0.0.0 to 10.0.0.5 LTS and CD are affected by this vulnerability.

The CVSS score of 7.1 indicates moderate severity. EPSS is not available, so the exact likelihood of exploitation is unclear, though the flaw is remotely exploitable. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a remote attacker sending a crafted XML message over the network to an MQ instance that processes XML, enabling the XXE flaw to read sensitive data or abuse memory resources.