Summary
CVE-2026-16626 is an unauthenticated XML External Entity (XXE) injection vulnerability (CWE-611) in Jaspersoft JasperReports Server. An unauthenticated, network-based attacker can abuse improper restriction of XML external entity references during XML parsing to read sensitive data and impact integrity. It carries a CVSS 4.0 base score of 9.3 (Critical).
Technical details
- Root cause: Improper restriction of XML external entity references when the server parses attacker-supplied XML (CWE-611).
- Trigger conditions: Reachable without authentication; no privileges, no user interaction, and low attack complexity are required.
- Attack vector: Network — an attacker submits crafted XML containing external entity references to the server.
- Impact: High confidentiality and high integrity impact, with low availability impact per the CVSS vector.
Affected software
- JasperReports Server from 9.0.0 before HF-9
- JasperReports Server from 10.0.0 before HF-10
Severity
- CVSS v4.0 base score: 9.3 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Mitigation and recommended actions
- Immediate: Apply the vendor hotfixes — upgrade 9.0.0 installations to HF-9, and 10.0.0 installations to HF-10, as directed in the Jaspersoft security advisory (August 5, 2026).
- If no patch: Enable JasperReports Server’s DOCTYPE/XXE protection so that XML files containing DOCTYPE declarations are rejected, and restrict network access to the server so untrusted clients cannot reach it until the hotfix is applied.

