# CVE-2026-6807: NSA GRASSMARLIN XML External Entity reference in session data processing

Source: https://junglewise.ai/threats/cve-2026-6807-nsa-grassmarlin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-6807 · Severity: high · CVSS 5.5 · Published 2026-04-28

NSA GRASSMARLIN, a tool used for mapping and visualizing Industrial Control Systems (ICS) and network topologies, is vulnerable to a flaw that could allow an attacker to access sensitive information. By providing specially crafted session data, an attacker could exploit the way the software processes XML files to read local system data. Because the project reached end-of-life status in 2017, no official patches will be released, and users are advised to migrate to supported alternatives or implement strict access controls.

Vendors: [National Security Agency](https://junglewise.ai/threats/vendors/national-security-agency).

## Quick answers

**Is CVE-2026-6807 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6807 being exploited in the wild.

**How severe is CVE-2026-6807?** High severity, with a CVSS score of 5.5, published 28 April 2026.

**Which products and versions are affected?** National Security Agency GRASSMARLIN All versions up to and including 3.2.1.

**Is there a fix for CVE-2026-6807?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6807 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-6807?** Check whether you run National Security Agency GRASSMARLIN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Improper Restriction of XML External Entity Reference (XXE) exists in NSA GRASSMARLIN (specifically confirmed in v3.2.1). The flaw is rooted in insufficient hardening of the XML parsing component when processing session data. A local attacker with low privileges can provide a crafted XML-based session file that triggers the parser to resolve external entities, potentially leading to the disclosure of sensitive local files or internal network information. As the product has been end-of-life (EOL) since 2017, the vendor has stated that no patches will be issued.

## Affected products

- NSA GRASSMARLIN All versions up to and including 3.2.1

## Timeline

- 2017: other: Project reached end-of-life (EOL) status
- 2026-04-28: advisory: Initial publication of ICSA-26-118-01

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01)