Recommended action window: Monitor and triage in normal cycle
NVD description
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
@iliaa @i0n1c Well, I have different experiences with Ms Copilot (Enterprise): For example, asked it to explain CVE-2026-92877 & create a PoC since we wanted to test out app whether it's vulnerable. It declined. After explaining that I'm a testing our software b4 rolling out -> 👍