CVE-2026-123029: XEE
Published Nov 5, 2026
·Updated
Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.
Event History
Nov 5, 2026
CVE Published
via MITRE·06:45 AM
Data Sourced
via MITRE·06:45 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker does not need authentication or user interaction to exploit the issue, provided they can send XML that Wowza Streaming Engine processes.
2
What is the impact of successful exploitation?
An attacker can read local files accessible to the Wowza Streaming Engine process. The scope of exposed data depends on that process's filesystem permissions.
3
Which deployments are affected?
Wowza Streaming Engine versions before 4.12.2 are affected. The provided information does not identify any configuration prerequisite beyond XML external entity processing.