CWE-611: XML External Entity (XXE) vulnerabilities

CVE-2026-76958 is an XML External Entity (XXE) vulnerability in SAP Integration Suite where XML documents from untrusted sources are not sufficiently validated. An attacker with low privileges can submit crafted XML payloads to read sensitive files on the server, impacting confidentiality. The vulnerability may also cause resource exhaustion, affecting availability. There is no impact on data integrity.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.

CVE-2026-55848 is a high-severity vulnerability in mapfish-print, a component used for printing templated cartographic maps. The flaw involves improper restriction of XML external entity (XXE) references in the GML layer parsing functionality. Specifically, before fixed versions, mapfish-print accepts attacker-controlled GML layer URLs that are parsed without disabling external entities and DTDs, allowing unauthenticated attackers to read sensitive local files or perform server-side request forgery (SSRF). This vulnerability affects multiple versions prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, where the issue has been resolved.

This release of Red Hat build of Apicurio Registry 3.3.1 GA includes the following security fixes. Security Fix(es): * DOMPurify: Cross-site scripting vulnerability allows code execution [rhint-serv-3] (CVE-2026-49978) * apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS [rhint-serv-3] (CVE-2026-12975) * apicurio-registry: SSRF via wsdl4j import dereference in WSDL FULL validation [rhint-serv-3] (CVE-2026-12992) * apicurio-registry: XML entity-expansion denial of service via internal DTD subset [rhint-serv-3] (CVE-2026-12993) * Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name [rhint-serv-3] (CVE-2026-44496) * DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization [rhint-serv-3] (CVE-2026-41240) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Dell Command Update (DCU) versions prior to 5.7.1 contain an XML External Entity (XXE) vulnerability (CWE-611). This flaw allows a low privileged local attacker to potentially perform server-side request forgery and elevate privileges. The vulnerability has a medium severity with a CVSS score of 6.5. No official patch link is provided in the data, but versions 5.7.1 and later are implied to have the fix.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an XML External Entity (XXE) vulnerability (CWE-611). This flaw allows a low privileged remote attacker to potentially cause information exposure. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No official patch or remediation details are provided in the input data.

CVE-2026-75058 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.2.1 that allows XML External Entity (XXE) attacks via the Eclipse settings importers. This flaw could lead to unauthorized disclosure of information. The issue has been fixed in version 2026.2.1.

CVE-2026-75055 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.2.1 where the Hadoop ResourceManager component could be exploited via XML External Entity (XXE) processing to read local files. This issue is fixed in version 2026.2.1. The vulnerability has a medium severity with a CVSS score of 5.5 and requires local access with user interaction to exploit.

CVE-2026-18715 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper restriction of XML external entity references (CWE-611), which could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability, only confidentiality. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 are vulnerable to an XML External Entity (XXE) attack due to improper restriction of XML external entity references in imported WSDL/XSD documents. While the top-level WSDL is processed securely with external entities disabled, imported documents are handled by WSDL4J, which does not disable these features, exposing the system to potential information disclosure. This vulnerability is identified as CWE-611 and has a CVSS score of 7.5, indicating high severity. Users are advised to upgrade to fixed versions 4.2.3, 4.1.8, or 3.6.12 to mitigate the risk.

IBM QRadar versions 7.5.0 through 7.5.0 UP 15 Interim Fix 005 and 7.6.0.0 through 7.6.0.1 contain an XML External Entity (XXE) injection vulnerability in the parseXmlPayload() function. This vulnerability occurs when XML-formatted syslog events are processed without authentication if XML-format property autodetection is enabled for at least one log source type. The vulnerability allows an attacker to exploit the XML parsing process via unauthenticated network input on port 514 (UDP/TCP).

An XML External Entity (XXE) vulnerability (CWE-611) exists in Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0, including source versions up to v20260630 and miChecker up to 3.1.0. Exploitation could allow a malicious actor to access local or internal network resources on systems running affected applications. The vulnerability has a medium severity with a CVSS 4.6 score. No official patch or remediation guidance has been provided yet.