CVE-2026-92877

The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.

CVSS 4.0

8.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-25)

CWE

CWE-611

Published

2026-10-12

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/eclipse-ee4j/jaxb-ri/pull/2013
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/310

Check your stackJSON