CVE-2026-92877: XEE

Published Oct 12, 2026

Updated

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.

Affected Software

1 affected component

JAXB

Event History

Oct 12, 2026

CVE Published

via MITRE·02:19 PM

Data Sourced

via MITRE·02:19 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using JAXB are exposed when they unmarshal attacker-controlled or otherwise untrusted XML on a JAXP implementation where FEATURE_SECURE_PROCESSING does not itself block external entity resolution.

What does an attacker need to exploit it?

An attacker needs a way to cause untrusted XML to be unmarshalled through JAXB. No authentication or user interaction is required according to the supplied CVSS vector, but exploitation has high attack complexity.

What is the impact of successful exploitation?

Successful exploitation can allow out-of-band XXE attacks that read local files accessible to the affected application.

CVE-2026-92877: XEE

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?