Medium severity · published Sep 10, 2026
CVE-2026-84941
Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
6.9
CVSS
0.5%
EPSS
No
On KEV
Description
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OV
OC200 v3 · TP-Link Systems Inc.
before 3.3.11 Build 20260711 · source: vendor
OV
OC2000 v1 · TP-Link Systems Inc.
before 1.41.11 Build 20260711 · source: vendor
OV
OC2000 v2 · TP-Link Systems Inc.
before 2.26.11 Build 20260711 · source: vendor
OV
OC220 v1 · TP-Link Systems Inc.
before 1.6.11 Build 20260711 · source: vendor
OV
OC220 v2 · TP-Link Systems Inc.
before 2.5.11 Build 20260711 · source: vendor
OV
OC300 v1 · TP-Link Systems Inc.
before 1.35.11 Build 20260711 · source: vendor
OV
OC400 v1 · TP-Link Systems Inc.
before 1.13.11 Build 20260711 · source: vendor
OS
Omada Software Controller (Linux) · TP-Link Systems Inc.
before 6.2.14.11 · source: vendor
OS
Omada Software Controller (Windows) · TP-Link Systems Inc.
before 6.2.14.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-84941
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-84941
support.omadanetworks.com
https://support.omadanetworks.com/en/document/133722/
support.omadanetworks.com
https://support.omadanetworks.com/en/download/software/omada-controller
support.omadanetworks.com
https://support.omadanetworks.com/us/download/software/omada-controller
www.omadanetworks.com
https://www.omadanetworks.com/en/support/download/
www.omadanetworks.com
https://www.omadanetworks.com/us/support/download/
More from OC200 v3
6.9
CVE-2026-81531
Unauthenticated Account Information Disclosure in Multiple Omada Controllers