CVE-2026-71375

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Scoring

Severity

HIGH

CVSS base score

7.4

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS probability

0.25%

CWE

CWE-611

Published

2026-09-08

Last modified

2026-09-08

Affected products

• Hitachi Cosminexus Component Container
• Hitachi Cosminexus Component Container
• Hitachi Cosminexus Component Container
• Hitachi Cosminexus Component Container
• Hitachi Cosminexus Component Container
• Hitachi Cosminexus Component Container
• Hitachi Cosminexus Component Container
• Hitachi Cosminexus Component Container

Weakness type

• CWE-611

Related vulnerabilities

• CVE-2026-84941 — Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
• CVE-2026-19596 — OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
• CVE-2026-19614 — XML External Entity (XXE) Injection in CyberELF NanoXML
• CVE-2026-76958 — XML External Entity (XXE) Vulnerability in SAP Integration Suite
• CVE-2026-17443 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
• CVE-2026-17444 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
• CVE-2026-81832 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
• CVE-2026-82525 — Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing

Markdown version · Browse all CVEs