Is CVE-2026-92001 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92001 being exploited in the wild.

How severe is CVE-2026-92001?

Medium severity, with a CVSS score of 6.1, published 23 September 2026.

Which products and versions are affected?

Apache Sling XSS before 2.4.12.

Is there a fix for CVE-2026-92001?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92001 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92001?

Check whether you run Apache Sling XSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92001: Apache Sling XSS XML entity expansion vulnerability

CVE-2026-92001 · Severity: medium · CVSS 6.1 · Published 2026-09-23

Apache Sling XSS, a cross-site scripting protection library, contains a vulnerability that fails to restrict recursive XML entity references in document type definitions. An attacker could exploit this by crafting a malicious XML document with nested entity definitions to consume excessive server resources, causing a denial of service. Organizations using Sling XSS for web security should upgrade immediately.

Technologies: Apache Sling XSS. Vendors: Apache.

Quick answers

Is CVE-2026-92001 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92001 being exploited in the wild.
How severe is CVE-2026-92001?: Medium severity, with a CVSS score of 6.1, published 23 September 2026.
Which products and versions are affected?: Apache Sling XSS before 2.4.12.
Is there a fix for CVE-2026-92001?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92001 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92001?: Check whether you run Apache Sling XSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper restriction of recursive entity references in DTDs (XML entity expansion or "billion laughs" attack) affecting the XML parsing functionality. The issue allows an unauthenticated attacker with network access to submit a specially crafted XML document that triggers exponential entity expansion, consuming CPU and memory resources and denying service to legitimate users. The fix was introduced in version 2.4.12.

Affected products

Apache Sling XSS before 2.4.12

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.