IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
**Risk verdict:** High risk for reachable deployments; exploitation status is unconfirmed because KEV, SSVC, PoC and EPSS data were not provided.
**Why this matters:** Successful exploitation could expose sensitive files or information accessible to the MQ service account, and may exhaust memory enough to disrupt file-transfer processing. Attackers could use disclosed data to support further compromise or cause operational delays in systems that depend on timely transfers.
**Most likely attack path:** A remote attacker needs network access and low-level privileges, but no user action; low attack complexity makes the path practical wherever the affected XML-processing function is reachable. Scope is unchanged, so direct impact is confined to the vulnerable security authority, though stolen data or service disruption could enable follow-on activity elsewhere.
**Who is most exposed:** Organisations running MQ Managed File Transfer for partner, customer or internal exchanges are most exposed, particularly where interfaces are broadly reachable or service accounts can read sensitive files.
Review MQ and MFT logs for unusual XML submissions, parsing errors or repeated failed requests.
Look for unexpected outbound connections from MQ hosts during XML processing.
Alert on MQ processes accessing sensitive files outside normal transfer paths.
Monitor memory spikes and transfer-queue backlogs associated with anomalous requests.
Mitigation and prioritisation
Apply the relevant IBM security fix for each deployed release; confirm completion through asset and package inventory.
Restrict network access to MFT interfaces and limit low-privilege account access.
Where patching is delayed, disable or isolate affected XML-processing paths if operationally safe.
Test changes against transfer workflows and partner integrations before production rollout.
KEV and EPSS status are unavailable, so the priority 1 threshold cannot be assessed; obtain these signals to refine urgency.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
