IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 are vulnerable to an XML External Entity (XXE) injection vulnerability (CWE-611). This vulnerability arises from improper restriction of XML external entity references during XML data processing. A remote attacker with low privileges can exploit this to disclose sensitive information or cause memory exhaustion. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, privileges required low, no user interaction, and impact primarily on confidentiality and availability.

Successful exploitation can lead to sensitive information disclosure and partial denial of service through memory resource consumption. The attacker requires low privileges and no user interaction, making exploitation feasible in networked environments. Integrity is not impacted according to the CVSS vector.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to XML processing features and monitor for suspicious activity related to XML input handling.