CVE-2026-16626: JasperReports Server XXE Vulnerability

CVE-2026-16626 Overview

CVE-2026-16626 is an unauthenticated XML External Entity (XXE) vulnerability in Jaspersoft JasperReports Server. The flaw is tracked under CWE-611: Improper Restriction of XML External Entity Reference. Attackers can exploit the vulnerability over the network without authentication or user interaction.

The issue affects JasperReports Server versions 9.0.0 before HF-9 and 10.0.0 before HF-10. Successful exploitation exposes confidential data on the server and can facilitate server-side request forgery against internal systems.

Critical Impact
Remote unauthenticated attackers can read arbitrary files, exfiltrate sensitive configuration data, and pivot to internal services through the JasperReports Server XML parser.

Affected Products

Jaspersoft JasperReports Server 9.0.0 before HF-9
Jaspersoft JasperReports Server 10.0.0 before HF-10

Discovery Timeline

2026-08-10 - CVE-2026-16626 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-16626

Vulnerability Analysis

JasperReports Server processes XML input through parsers that do not disable external entity resolution. An attacker submits a crafted XML document containing an external entity declaration. The parser resolves the reference and includes the fetched content in the parsed document.

The endpoint accepting XML input does not require authentication, which increases exposure. Attackers reach the vulnerable code path directly over HTTP or HTTPS. The Common Weakness Enumeration classifies this issue as [CWE-611].

Exploitation typically achieves file disclosure, internal port scanning, or blind data exfiltration through out-of-band channels. Sensitive files such as /etc/passwd, application configuration files containing database credentials, and cloud metadata endpoints are common targets. The vulnerability also enables server-side request forgery (SSRF) against services reachable from the report server.

Root Cause

The root cause is an insecure XML parser configuration. Java XML parsers such as DocumentBuilderFactory, SAXParserFactory, and XMLInputFactory resolve external entities by default. Jaspersoft did not disable DOCTYPE declarations or external entity resolution on affected code paths. Any XML input flowing through these parsers can therefore reference remote or local resources.

Attack Vector

An unauthenticated attacker sends an HTTP request containing an XML payload with a DOCTYPE declaration and an external entity. The entity resolves a file:// URI to read local files or an http:// URI to reach internal network services. The server returns the resolved content in the response, in error messages, or through an attacker-controlled callback for blind exploitation.

See the Jaspersoft Security Advisory August 2026 for vendor-provided details.

Detection Methods for CVE-2026-16626

Indicators of Compromise

Inbound HTTP requests to JasperReports Server endpoints containing <!DOCTYPE, <!ENTITY, SYSTEM, or PUBLIC keywords in XML bodies
Outbound DNS or HTTP requests from the JasperReports Server host to unexpected external domains, indicating out-of-band XXE exfiltration
JasperReports Server accessing local files such as /etc/passwd, /etc/shadow, or application configuration files outside normal operation
Application logs showing XML parsing errors referencing external entity resolution failures

Detection Strategies

Inspect web application firewall logs for XML payloads containing DOCTYPE or ENTITY tokens directed at JasperReports Server URIs
Correlate JasperReports Server process activity with unexpected file reads or outbound network connections from the host
Monitor for anomalous SSRF-like traffic originating from the report server toward cloud metadata endpoints such as 169.254.169.254

Monitoring Recommendations

Enable verbose logging on the JasperReports Server XML processing components and forward logs to a centralized SIEM
Deploy egress filtering and alert on any outbound traffic from the report server to non-approved destinations
Track file access patterns of the JasperReports Server service account for reads outside its expected working directories

How to Mitigate CVE-2026-16626

Immediate Actions Required

Apply Hot Fix HF-9 for JasperReports Server 9.0.0 or HF-10 for 10.0.0 as published in the Jaspersoft advisory
Restrict network access to JasperReports Server administrative and XML-processing endpoints to trusted networks only
Audit report definitions, data sources, and recent XML uploads for signs of prior exploitation

Patch Information

Jaspersoft released fixes in HF-9 for the 9.0.0 branch and HF-10 for the 10.0.0 branch. Refer to the Jaspersoft Security Advisory August 2026 for hotfix download locations and installation instructions.

Workarounds

Place JasperReports Server behind a web application firewall configured to reject XML payloads containing DOCTYPE or external entity declarations
Block outbound network access from the JasperReports Server host to prevent out-of-band data exfiltration and SSRF
Restrict the file system permissions of the JasperReports Server service account to the minimum required paths

bash

# Example egress restriction using iptables to block outbound HTTP/HTTPS
# from the JasperReports Server host, allowing only approved destinations.
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT