The vulnerability stems from insecure XML processing during Qualys Cloud Services connectivity checks. The advisory explicitly states the plugin didn't restrict XXE, which typically manifests in XML parser configuration. The connectivity check endpoint would involve parsing XML responses - a prime candidate for XXE if parser security features aren't enabled. While exact function names aren't provided, Java XML parsing patterns (DocumentBuilderFactory/SAXParser without setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)) strongly indicate this implementation flaw. The missing permission check allows attackers to trigger this vulnerable code path.