CVE-2026-14304: In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it…

Description

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 14% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EA

Eclipse Accessibility Tools Framework (ACTF) · Eclipse Foundation

0.5.0 through 1.6.0; through v20260630 · source: vendor

AT

Accessibility Tools Framework · Eclipse

0.5.0 through 1.6.0 · source: NVD

MI

Michecker · Soumu

before 3.2.0 · source: NVD