Is CVE-2026-62971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62971 being exploited in the wild.

How severe is CVE-2026-62971?

High severity, with a CVSS score of 7.2, published 11 November 2026.

Which products and versions are affected?

OWASP Core Rule Set before 3.3.10, before 4.25.1, before 4.28.0.

Is there a fix for CVE-2026-62971?

Yes: fixed in 3.3.10, 4.25.1, 4.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62971 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62971?

Check whether you run OWASP Core Rule Set at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62971: OWASP Core Rule Set XML attribute bypass in attack detection

CVE-2026-62971 · Severity: high · CVSS 7.2 · Published 2026-11-11

The OWASP Core Rule Set (CRS) is a set of attack detection rules used by web application firewalls to block common web attacks. Prior to versions 3.3.10, 4.25.1, and 4.28.0, the ruleset failed to inspect XML attribute values, allowing attackers to bypass detection of XSS, SQL injection, RFI, RCE, and other attacks by embedding payloads inside XML attributes instead of element text. This leaves web applications protected by vulnerable CRS versions open to attacks that should have been blocked.

Technologies: OWASP Core Rule Set. Vendors: OWASP.

Quick answers

Is CVE-2026-62971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62971 being exploited in the wild.
How severe is CVE-2026-62971?: High severity, with a CVSS score of 7.2, published 11 November 2026.
Which products and versions are affected?: OWASP Core Rule Set before 3.3.10, before 4.25.1, before 4.28.0.
Is there a fix for CVE-2026-62971?: Yes: fixed in 3.3.10, 4.25.1, 4.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62971 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62971?: Check whether you run OWASP Core Rule Set at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.10, 4.25.1, 4.28.0

Technical details

CRS rules in nine families (921, 930, 931, 932, 933, 934, 941, 942, 943) use the XPath expression XML:/* to inspect XML request bodies, which matches only element text nodes and not attribute values. Attackers can evade detection by placing attack payloads (XSS, SQLi, RCE, etc.) inside XML attribute values—a purely syntactic bypass that works at all paranoia levels. The fix adds XML://@* to the variable list to inspect attribute values as well; only the 944 (Java) family was already correct.

Affected products

OWASP Core Rule Set before 3.3.10, before 4.25.1, before 4.28.0

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.