This vulnerability in IBM MQ versions 9.1.0.0 through 10.0.0.0 arises from improper handling of XML external entities during RFH2 folder parsing. An authenticated attacker could exploit this flaw to read files from a vulnerable .NET client or cause a limited denial of service. The issue is classified under CWE-611 (Improper Restriction of XML External Entity Reference). The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation allows an authenticated attacker to read files from the vulnerable .NET client or cause a limited denial of service condition. Confidentiality impact is high, while integrity impact is none and availability impact is low.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict access to authenticated users and monitor for suspicious activity related to RFH2 folder parsing.