CVE-2026-46722
NoneCVSS
—
EPSS
0.4%
Published
May 19, 2026
CISA due date
—
The record
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89260 MoguBlog through 6.2 contains an XML external entity injection vulnerability in the… CWE-611
- CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of… CWE-611
- CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribution… CWE-611
- CVE-2026-19614 The API is prone to XML external entity (XXE) injection. CWE-611
- CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexus… CWE-611
- CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from… CWE-611
- CVE-2026-17444 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611
- CVE-2026-17443 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611