CVE-2026-118468
Received Received - Intake

XML External Entity (XXE) Vulnerability in XML Parser

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: ENISA

Description
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-118468

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
CompuGroup Medical Infantia From 0 (inc) to 6.1.1 (inc)
CompuGroup Medical Profim From 0 (inc) to 6.1.1 (inc)
CompuGroup Medical Phronesis From 0 (inc) to 4.51.0 (inc)
CompuGroup Medical Venere From 0 (inc) to 8.33.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves XML parsers processing attacker-controlled update manifests or network responses with external entity resolution enabled. This allows attackers to exploit XML External Entity (XXE) attacks, which can lead to unauthorized data access or system compromise.

Detection Guidance

Detecting XXE vulnerabilities typically involves checking XML parsers for external entity resolution. Inspect application logs for unusual network requests or parsing errors. Use tools like OWASP ZAP or Burp Suite to scan for XXE patterns in XML inputs. Examine system configurations for XML parsing libraries with external entity resolution enabled.

Impact Analysis

An attacker could exploit this to read sensitive files, perform denial-of-service attacks, or execute arbitrary code on systems using vulnerable XML parsers. This may lead to data breaches, system outages, or further network infiltration.

Compliance Impact

This vulnerability can lead to unauthorized data exposure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Disable external entity resolution in XML parsers. Update XML libraries to versions that disable XXE by default. Configure XML parsers to use secure settings (e.g., DTD processing disabled). Restrict network access to XML parsing components. Apply patches or updates from vendors for affected CompuGroup Medical products.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...