IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.
**Risk verdict:** This is a significant risk for exposed deployments, but urgency cannot be fully ranked because KEV, SSVC, PoC and EPSS status are not provided.
**Why this matters:** Successful exploitation could expose sensitive data accessible to the MQ process and undermine the integrity of message-driven workflows; malformed input may also disrupt service. Attackers could use this to obtain business or operational information, or interfere with file-transfer and application integrations.
**Most likely attack path:** An attacker needs network reachability and low-level authentication or queue permissions, but no user action or complex setup is indicated. They would target command queue processing with crafted XML; the unchanged scope suggests impact is centred on the affected MQ environment, though disclosed data could support further attacks.
**Who is most exposed:** Prioritise organisations running Managed File Transfer on reachable MQ infrastructure, especially where partner, application or operator accounts can submit commands.
Review command queue submissions for XML containing `DOCTYPE`, external entity declarations or unexpected system identifiers.
Correlate queue activity with outbound DNS or HTTP requests from MQ hosts.
Alert on unusual file reads, sensitive-data access or MQ process resource spikes.
Check for unexpected command submissions by service and partner accounts.
Mitigation and prioritisation
Apply IBM’s fixed cumulative security update or fix pack for the deployed support stream; verify the change against the vendor advisory.
Restrict command queue access to essential, named accounts and review inherited permissions.
Limit MQ host egress, particularly DNS and web traffic, where operationally feasible.
Test the update in a representative environment, then schedule prompt production rollout and validate MFT flows.
Obtain current KEV, SSVC and EPSS data before final ranking; their absence leaves exploitation likelihood uncertain.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
