CVE-2026-92877

CVSS 8.3 (high) · published 2026-10-12

The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.

Weakness: CWE-611

Source: NVD CVE-2026-92877

References

• https://github.com/eclipse-ee4j/jaxb-ri/pull/2013
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/310

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.