CVE WatchJul 17, 2026

CVE-2026-8396

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking.

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

0-100

Published: Jul 17, 2026 · Last modified: Jul 17, 2026 · CWE-611

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2.

Official references

siberguvenlik.gov.trhttps://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0570

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-684938.1 HIG

97.5%

——29Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.3d CVE-2026-261717.5 HIG

75.4%

——23Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.3d CVE-2020-259129.1 CRI

68.1%

——20A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).9d CVE-2023-269999.8 CRI

60.5%

——18An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.9d CVE-2021-450249.8 CRI

59.5%

——18ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).9d CVE-2023-241877.8 HIG

56.2%

——17An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.9d