CVE-2026-92877
The JAXB factory methods historically relied solely on to prevent XML External Entity (XXE) resolution.
Published Oct 12, 2026 · updated Oct 15, 2026
The JAXB factory methods historically relied solely on to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 12, 2026 · NIST NVD
Detected
The JAXB factory methods historically relied solely on to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Oct 15, 2026 · NIST NVD
Updated
The JAXB factory methods historically relied solely on to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Sources
- CVE.orgVulnerability recordCVE-2026-92877
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-92877
The JAXB factory methods historically relied solely on to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled throu
nvd.nist.gov