CVE-2026-78224: XSLT Transformer XXE Vulnerability

CVE-2026-78224 Overview

CVE-2026-78224 is an XML External Entity (XXE) injection vulnerability affecting the XSLT Transformer Step component. The flaw stems from instantiating a bare TransformerFactory without configuring the required security features, leaving the XML parser open to external entity resolution. Attackers can craft malicious XSLT or XML input that references external entities, enabling data exfiltration from the host and denial-of-service conditions through entity expansion or resource enumeration. The issue was published to the National Vulnerability Database (NVD) on September 11, 2026 and is tracked in CISA Medical Advisory ICSMA-26-253-01, indicating impact on medical device software.

Critical Impact
Unauthenticated network attackers can exfiltrate sensitive files and disrupt service availability through malicious XSLT input processed by the vulnerable transformer.

Affected Products

Products referenced in CISA Medical Advisory ICSMA-26-253-01
Software components implementing the XSLT Transformer Step with an unsecured TransformerFactory
Downstream integrations that pass untrusted XML or XSLT to the transformer

Discovery Timeline

2026-09-11 - CVE-2026-78224 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-78224

Vulnerability Analysis

The XSLT Transformer Step builds a TransformerFactory instance without enabling the secure processing feature or disabling external DTD and stylesheet resolution. Java's default TransformerFactory resolves external entities and external stylesheet references unless explicitly restricted. When untrusted XML or XSLT reaches this factory, an attacker can define external entities that pull content from local files or internal network resources. The parser then embeds that content into transformation output or leaks it through error responses. The same weakness enables denial-of-service through recursive entity expansion patterns and slow external resource lookups that block worker threads.

Root Cause

The root cause is a missing hardening step during factory construction, classified as [CWE-611] Improper Restriction of XML External Entity Reference. The code omits calls to setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true) and does not set ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET to empty strings. Without these controls, the underlying XML parser honors SYSTEM and PUBLIC identifiers in DOCTYPE declarations and xsl:import or xsl:include directives.

Attack Vector

Exploitation requires only network reachability to a service that submits attacker-controlled XML or XSLT to the transformer step. No authentication or user interaction is required. An attacker submits a payload containing a DOCTYPE with an external entity reference, then observes reflected content or side-channel signals such as timing and outbound DNS lookups. Because the vulnerability is described in a CISA medical advisory, exposure in clinical data pipelines raises concerns about protected health information disclosure.

No verified public exploit code is available. See the CISA Medical Advisory ICSMA-26-253-01 and the CSAF JSON advisory for authoritative technical details.

Detection Methods for CVE-2026-78224

Indicators of Compromise

Inbound XML or XSLT payloads containing <!DOCTYPE> declarations with SYSTEM or PUBLIC external entity references.
Unexpected outbound DNS lookups or HTTP requests originating from the transformer process to attacker-controlled hosts.
Application logs showing file read operations on paths such as /etc/passwd, private key stores, or configuration files during XSLT processing.
Repeated transformer timeouts or worker thread exhaustion coinciding with malformed XML input.

Detection Strategies

Deploy web application firewall or API gateway rules that flag XML bodies containing DOCTYPE declarations or entity definitions.
Enable verbose logging on the XSLT transformer step to capture entity resolution attempts and external resource fetches.
Correlate application error logs with egress network telemetry to identify parser-driven outbound connections.

Monitoring Recommendations

Monitor process-level file access from Java Virtual Machine (JVM) instances hosting the transformer for reads outside expected working directories.
Alert on any DNS resolution from application servers targeting untrusted external domains during XML processing windows.
Track CPU and memory spikes on transformer nodes that may indicate entity expansion or billion-laughs style attacks.

How to Mitigate CVE-2026-78224

Immediate Actions Required

Apply the vendor patch referenced in CISA Medical Advisory ICSMA-26-253-01 as soon as it is available for your deployment.
Restrict network exposure of the XSLT Transformer Step to trusted internal sources until patched.
Validate and reject any XML input containing DOCTYPE declarations at the application boundary.
Rotate any credentials, keys, or tokens that were readable by the transformer process during the exposure window.

Patch Information

Refer to the CISA Medical Advisory ICSMA-26-253-01 and the accompanying CSAF advisory file for authoritative vendor patch details and affected version ranges. The NVD entry does not enumerate fixed versions at time of publication.

Workarounds

Reconfigure the transformer to construct TransformerFactory with FEATURE_SECURE_PROCESSING enabled and ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET set to empty strings.
Place the affected service behind an XML-aware proxy that strips DOCTYPE declarations from inbound payloads.
Apply egress network filtering to block the transformer host from initiating arbitrary outbound connections.

bash

# Java system property hardening for XSLT/XML processing
java \
  -Djavax.xml.accessExternalDTD="" \
  -Djavax.xml.accessExternalStylesheet="" \
  -Djavax.xml.accessExternalSchema="" \
  -Djdk.xml.entityExpansionLimit=0 \
  -jar your-application.jar