CVE-2026-82578: XML Batch Processing XXE Vulnerability

CVE-2026-82578 Overview

CVE-2026-82578 is an XML External Entity (XXE) injection vulnerability [CWE-611] affecting a medical device covered by CISA advisory ICSMA-26-253-01. When XML batch processing is enabled and the XPath option is selected, raw batch input is parsed with a default XPath/JAXP configuration that does not restrict external entity resolution. Attackers can supply crafted XML documents containing external entity declarations to exfiltrate local files or trigger denial-of-service conditions against the parser. The flaw is network-exploitable, requires no authentication, and needs no user interaction, giving remote attackers a low-friction path to sensitive data.

Critical Impact
Unauthenticated remote attackers can exfiltrate confidential data and disrupt XML batch processing by injecting external entities into XPath-parsed input.

Affected Products

Medical device products covered by CISA advisory ICSMA-26-253-01
Deployments where XML batch processing is enabled
Configurations using the XPath processing option with default JAXP settings

Discovery Timeline

2026-09-11 - CVE-2026-82578 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-82578

Vulnerability Analysis

The vulnerability arises in the XML batch processing pipeline when the XPath option is selected. Incoming batch payloads are handed directly to a Java API for XML Processing (JAXP) parser configured with default factory settings. Default JAXP configurations permit resolution of external entities and external DTDs, which enables classic XXE attack primitives.

An attacker who can submit batch input to the affected endpoint can define an external entity referencing a local file path or a network resource. When the parser expands the entity during XPath evaluation, the referenced content is returned in query results or influences server behavior. This exposes host file contents and internal network reachability to unauthenticated remote callers.

Because exploitation requires only a crafted XML document, the attack surface is broad and does not depend on protocol-level authentication. The same parser behavior enables denial-of-service through entity expansion techniques such as recursive entity references, which exhaust CPU and memory during parsing.

Root Cause

The root cause is the use of a default XPathFactory and JAXP parser configuration that leaves external entity resolution and external DTD loading enabled. Secure hardening flags such as FEATURE_SECURE_PROCESSING, disallow-doctype-decl, and XMLConstants.ACCESS_EXTERNAL_DTD are not applied to the batch parser instance.

Attack Vector

Exploitation occurs over the network. An attacker submits an XML batch document containing a <!DOCTYPE> declaration with an external entity, for example referencing file:/// URIs to read local files or http:// URIs to trigger server-side requests. The parser evaluates the entity during XPath processing, and the resolved content is either reflected to the attacker or consumed by the server, producing information disclosure or denial-of-service outcomes.

The vulnerability mechanism is documented in the CISA Medical Advisory ICSMA-26-253-01 and the corresponding GitHub CSAF Document. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2026-82578

Indicators of Compromise

Inbound XML batch requests containing <!DOCTYPE> declarations or <!ENTITY> definitions referencing SYSTEM identifiers
Outbound network connections from the XML processing host to attacker-controlled URLs shortly after batch submissions
Unexpected reads of sensitive files such as /etc/passwd, private keys, or application configuration files by the batch processing service account
Parser errors or resource exhaustion events tied to recursive entity expansion patterns

Detection Strategies

Inspect application and reverse-proxy logs for XML payloads containing external entity declarations submitted to XPath-enabled batch endpoints
Alert on file-read syscalls made by the XML processing process against paths outside its expected working directories
Correlate spikes in CPU and memory consumption on the batch processing service with inbound XML request patterns

Monitoring Recommendations

Enable verbose logging on the XML batch processor to capture parsed DTD and entity references for audit review
Monitor egress traffic from XML processing hosts and treat any callouts to untrusted destinations as high-priority alerts
Track failed and long-running XPath queries as potential indicators of XXE or entity expansion attempts

How to Mitigate CVE-2026-82578

Immediate Actions Required

Disable the XML batch processing feature or the XPath option until a vendor patch is applied
Restrict network access to XML batch endpoints so only trusted client systems can submit input
Apply an application-layer filter that rejects XML documents containing <!DOCTYPE> or external ENTITY declarations

Patch Information

Refer to the CISA Medical Advisory ICSMA-26-253-01 and the associated GitHub CSAF Document for vendor remediation guidance and fixed versions. No standalone vendor advisory URLs were listed in the CVE record at publication time.

Workarounds

Configure the underlying JAXP parser with FEATURE_SECURE_PROCESSING set to true and disallow-doctype-decl enabled
Set XMLConstants.ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA to empty strings to block external resource loading
Deploy a web application firewall rule that blocks XML payloads containing SYSTEM or PUBLIC entity identifiers
Enforce request size limits and entity expansion caps on the batch processor to reduce denial-of-service exposure

bash

# Configuration example - hardening a JAXP XPath parser
# Apply equivalent settings in the affected product's configuration
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);