An XML external entity (XXE) injection flaw exists in IBM MQ’s XML processing library. The vulnerability allows a malicious actor to craft XML payloads containing external entity references that, when parsed, can lead to the disclosure of sensitive information stored on the MQ server or to the consumption of server memory. The impact is primarily a confidentiality breach and potential denial of service through resource exhaustion.

IBM offers MQ as a managed messaging platform. The flaw affects IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD. Users running any of these releases are vulnerable unless they apply the vendor‑supplied cumulative security updates or patches.

The CVSS score for this issue is 7.1, indicating a high severity potential. The EPSS score is currently unavailable, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation at the time of reporting. The attack vector is inferred to be remote, as an attacker can submit malicious XML data over the network to the MQ service. Exploitation would require sending crafted XML documents to the MQ server, which is typically reachable from external networks or other workstations within the organization.