IBM MQ Managed File Transfer allows an attacker with valid credentials to inject malicious environment variables into the transfer request metadata. The injected variables are processed by the MQ engine at execution time, giving the attacker the ability to run arbitrary code on the host that services the transfer. The flaw is an example of a configuration flaw (CWE‑15) that can lead to full remote code execution and thereby compromise confidentiality, integrity, and availability of the affected system.

Affected versions include IBM MQ 9.2 LTS 9.2.0.0 through 9.2.0.44, IBM MQ 9.3 LTS 9.3.0.0 through 9.3.0.42, IBM MQ 9.4 LTS 9.4.0.0 through 9.4.0.26 and CD 9.4.0.0 through 9.4.5.1, and IBM MQ 10.0 LTS 10.0.0.0 through 10.0.0.5 as well as the CD releases 10.0.0.0 through 10.0.0.5. All these builds are part of the LTS and community‑delivered lines of IBM MQ and are identified by the CPE strings provided.

The CVSS score of 8.8 signals a high severity vulnerability. While an EPSS score is not available, the lack of public evidence of exploitation does not diminish the risk because the flaw enables remote code execution once authenticated. Because the attack requires authenticated access to the transfer service, an attacker must compromise user credentials or exploit poor authentication controls. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but libraries of IBM MQ remain common in enterprise environments, which increases the potential impact.