CVE-2026-118468: AIS XML parsers allow external entity resolution

Published Nov 9, 2026

Updated

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

Affected Software

1 affected component

AIS XML parsers

Event History

Nov 9, 2026

CVE Published

via MITRE·11:58 AM

Data Sourced

via MITRE·11:58 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions must be met for exploitation?

An attacker must be able to influence an update manifest or a network response that is processed by an affected AIS XML parser. Exploitation also depends on external entity resolution being enabled and has high attack complexity.

Is authentication or user interaction required?

No privileges or user interaction are required according to the supplied vector. The attack can be performed over the network, but requires the additional conditions reflected by the high attack complexity and attack requirements metrics.

What is the potential impact?

Successful XXE exploitation can have high impact on confidentiality, integrity, and availability of the vulnerable component. No impact on subsequent systems is indicated in the supplied vector.

CVE-2026-118468: AIS XML parsers allow external entity resolution

Affected Software

Event History

Frequently Asked Questions

What conditions must be met for exploitation?

Is authentication or user interaction required?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

What conditions must be met for exploitation?

Is authentication or user interaction required?

What is the potential impact?