Executive brief
A software component used to process XML data in batch mode has a vulnerability that allows attackers to inject malicious XML entities when the XPath option is enabled. An attacker can exploit this to steal sensitive data from the system or cause denial-of-service attacks that disrupt operations.
Technical details
This is an XML External Entity (XXE) injection vulnerability in XML batch processing functionality. The root cause is that when XPath option is selected, the default XPath/JAXP configuration lacks entity restrictions, allowing untrusted XML input to process external entity declarations. No authentication is required; an attacker can supply crafted XML to the batch processor. Successful exploitation enables data exfiltration of sensitive files and denial-of-service through billion laughs attacks or external entity expansion. A patch should implement entity resolution restrictions or disable external entity processing by default.
Timeline
- 2026-09-11: disclosed