This vulnerability (CVE-2026-71375) in Cosminexus Component Container is due to improper restriction of XML external entity references (CWE-611). It affects a broad range of versions including from 09-00 through 09-00-18, 09-50 through 09-50-22, 09-70 before 09-70-28, 09-80 before 09-80-05, 09-87 before 09-87-10, 11-00 before 11-00-13, 11-10 through 11-10-11, 11-20 before 11-20-10, 11-30 through 11-30-08, 11-40 through 11-40-03, 11-50 through 11-50-03, 11-60 before 11-60-03, and 11-70-01 before 11-70-03. The CVSS 3.1 score is 7.4 (high), with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. No known exploits in the wild or vendor patch information is provided.

The vulnerability allows an attacker to exploit XML external entity processing to cause high confidentiality and availability impact. This could potentially lead to unauthorized disclosure of information and denial of service conditions. The attack requires no privileges or user interaction but has high attack complexity. The scope remains unchanged, meaning the impact is limited to the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor vendor communications for updates. Avoid processing untrusted XML inputs if possible until a fix is available.