CVE-2026-66089Medium· 6.1▾ SunlitIn openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the se…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
openEQUELLA < 2026.1Upgrade to the vendor recommended fixed versions
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-66090High· 7.1XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
CVE-2026-16889Medium· 4.8Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
CVE-2026-66088Critical· 9.4Unrestricted Command Execution via system.execute
CVE-2026-66091Medium· 6.9Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
CVE-2026-66092Medium· 4.8Stored XSS in pre-login notice via reachable legacy logon route
CVE-2026-67615High· 8.8openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/…