Medium severity · published Oct 29, 2026
CVE-2026-66089
XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
New
6.1
CVSS
–
EPSS
No
On KEV
Description
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openEQUELLA · Apereo Foundation
before 2026.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66089
vendor-advisory
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45
product
https://openequella.github.io/guides/
More from openEQUELLA
9.4
CVE-2026-66088
Unrestricted Command Execution via system.execute
8.8
CVE-2026-67615
openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
7.1
CVE-2026-66090
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
6.9
CVE-2026-66091
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
4.8
CVE-2026-66092
Stored XSS in pre-login notice via reachable legacy logon route