The vulnerability identified as CVE-2026-8396 in Netcad Software Inc.'s NetGIS product is classified under CWE-611, indicating improper restriction of XML external entity references. This flaw allows external linking through serialized data, potentially exposing sensitive information. The affected versions include 5.0.66 and versions prior to 7.2.2. The CVSS 3.1 score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a significant confidentiality impact. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information due to external entity references being improperly restricted in XML processing. The confidentiality impact is high, while integrity and availability impacts are not affected. This could allow attackers to access internal files or resources referenced by XML entities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling XML external entity processing if possible or apply any recommended configuration changes to restrict external entity resolution. Monitor vendor channels for updates.