CVE-2026-92877

waiting for further signals

GHSA-j929-4rw7-84fh ↗EUVD-2026-97469 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Eclipse Foundation jaxb-ri (core) 4.0.4; 4.0.9

CWE-611 Improper Restriction of XML External Entity Reference

ETK-2026-1393, permanent identifier

cvss8.3cna vendorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

8d 10h 45msince last run

12mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+3h44m

+2h

+6h

+8h

+10h

+12h

description

Eclipse JAXB RI core can permit external entity resolution while unmarshalling untrusted XML on affected JAXP implementations. An attacker able to supply XML to a JAXB unmarshal operation may read local files through out-of-band entity resolution when secure-processing is the only protection configured.

mitigation

Explicitly configure the XML parser used with JAXB to disable external entities and external DTD loading rather than relying only on secure-processing. Do not unmarshal untrusted XML until those controls are verified in the deployed JAXP runtime.

check

exploit

automation

contextual

auth required

EPSS

0.27%17th percentile

agent run time

12m

cve.org record, t = 0

2026-10-12 14:19Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-12 14:19Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-92877

this entry in the feed

GET /api/v1/feed/CVE-2026-92877

{
  "etk_id": "ETK-2026-1393",
  "cve_id": "CVE-2026-92877",
  "display_id": "CVE-2026-92877",
  "ghsa_id": "GHSA-j929-4rw7-84fh",
  "euvd_id": "EUVD-2026-97469",
  "status": "published",
  "anchor_state": "anchored",
  "title": "XXE in Eclipse JAXB RI factory methods",
  "summary": "Eclipse JAXB RI core can permit external entity resolution while unmarshalling untrusted XML on affected JAXP implementations. An attacker able to supply XML to a JAXB unmarshal operation may read local files through out-of-band entity resolution when secure-processing is the only protection configured.",
  "mitigation": "Explicitly configure the XML parser used with JAXB to disable external entities and external DTD loading rather than relying only on secure-processing. Do not unmarshal untrusted XML until those controls are verified in the deployed JAXP runtime.",
  "vendor": "Eclipse Foundation",
  "product": "jaxb-ri (core)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "4.0.4",
        "4.0.9"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "jaxb-ri (core)",
      "purl": null
    }
  ],
  "cwes": [
    611
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
  "epss_score": 0.0027,
  "epss_percentile": 0.1728,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.321226866666667,
  "t0_at": "2026-10-12T14:19:28.195000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T14:19:28.195000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T14:19:28.195000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92877"
    }
  }
}

published 2026-10-12 17:50Z
last change 2026-10-21 04:45Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.