CVE WatchSep 8, 2026

CVE-2026-71375

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Compon

CVSS

7.4

High

EPSS

0.2%

p16

KEV

—

Exploit Today

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-611

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-09-082026-09-09

Technical description

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Official references

www.hitachi.comhttps://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-131/index.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-19614—

14.0%

——4The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3.1d CVE-2026-769588.5 HIG

12.9%

——4SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.2d CVE-2026-174445.3 MED

21.5%

——6IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.1d CVE-2026-174435.3 MED

21.5%

20.0%

——6IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.2d CVE-2026-825255.5 MED

3.8%

——1Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item. Attackers can craft a malicious UFDR archive that, when previewed by an examiner, causes the XML parser to resolve file:// external entity references and execute msxsl:script within the external stylesheet to exfiltrate the resolved file contents to an attacker-controlled endpoint via a generated image URL.2d