CVE-2026-92877 XML external entity in jaxb-ri (core)
Attackers can read local files via out-of-band XXE when untrusted XML is unmarshalled by JAXB on JAXP implementations where secure processing alone fails to block external entities.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92877?
CVE-2026-92877 is a high-severity vulnerability in Eclipse Foundation jaxb-ri (core), published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Weakness: CWE-611
Which versions are affected by CVE-2026-92877?
How do I fix CVE-2026-92877?
No fix has been published for CVE-2026-92877 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92877 being exploited?
There is no known exploitation of CVE-2026-92877 in the wild and no public exploit code.
Sources
Also known as GHSA-j929-4rw7-84fh, UBUNTU-CVE-2026-92877.