CVE-2026-16626: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-16626 is an unauthenticated XML External Entity (XXE) injection vulnerability in Jaspersoft JasperReports Server, classified under CWE-611. It affects JasperReports Server versions from 9.0.0 before Hotfix 9 (HF-9) and from 10.0.0 before Hotfix 10 (HF-10). The vulnerability was disclosed on August 10, 2026, with Jaspersoft publishing a security advisory and the CVE being received by NVD on the same date. It carries a CVSS v4.0 base score of 9.3 (Critical), assigned by Jaspersoft as the CNA (GitHub Advisory, Jaspersoft Advisory).

The vulnerability stems from improper restriction of XML external entity references (CWE-611) in JasperReports Server's XML processing logic. An unauthenticated remote attacker can submit a specially crafted XML document containing malicious external entity declarations to a vulnerable endpoint; the server resolves these entities, potentially reading arbitrary files from the server filesystem or initiating server-side requests to internal network resources (SSRF). No authentication or user interaction is required, and attack complexity is low, making exploitation straightforward and automatable. CISA's SSVC assessment confirms the vulnerability is automatable with total technical impact (GitHub Advisory, Jaspersoft Advisory).

Successful exploitation allows an unauthenticated attacker to read sensitive files from the server (e.g., configuration files, credentials, private keys) and potentially probe or access internal network resources via server-side request forgery (SSRF). The CVSS v4.0 scoring reflects high confidentiality and integrity impact on the vulnerable system, with low availability impact. This could facilitate credential theft, lateral movement within internal networks, and further compromise of connected systems or databases (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.33% (26th percentile), indicating a relatively low near-term exploitation probability. However, CISA's SSVC assessment classifies the vulnerability as automatable with total technical impact, warranting prioritized patching (GitHub Advisory).

1. Reconnaissance: Identify internet-facing JasperReports Server instances running versions 9.0.0–HF-9 or 10.0.0–HF-10 using tools like Shodan or Censys, searching for JasperReports Server banners or login pages.
2. Identify XML-accepting endpoint: Locate an unauthenticated endpoint in JasperReports Server that accepts and processes XML input (e.g., report import or data source configuration endpoints).
3. Craft malicious XML payload: Construct an XML document with an external entity declaration pointing to a sensitive local file or internal network resource, for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

4. Submit the payload: Send the crafted XML to the vulnerable endpoint via an unauthenticated HTTP POST request.
5. Retrieve exfiltrated data: The server resolves the external entity and returns the contents of the referenced file in its response, or the attacker uses out-of-band techniques (e.g., DNS/HTTP callbacks to an attacker-controlled server) to exfiltrate data if direct response reflection is not available.
6. Pivot or escalate: Use retrieved credentials or configuration data (e.g., database passwords, API keys) to access additional systems or escalate privileges within the environment (GitHub Advisory, Jaspersoft Advisory).

• Network: Unexpected outbound HTTP or DNS requests from the JasperReports Server host to external or internal IP addresses not associated with normal operations; unusual DNS lookups originating from the server process.
• Logs: JasperReports Server access logs showing unauthenticated POST requests to XML-processing endpoints with unusually large or structured XML bodies; error messages referencing external entity resolution or file URI schemes (file:///) in application logs.
• File System: Evidence of file read attempts on sensitive files (e.g., /etc/passwd, /etc/shadow, application configuration files) reflected in OS-level audit logs (e.g., auditd on Linux).
• Process: Unusual network connections initiated by the JasperReports Server Java process to internal network segments or external attacker-controlled infrastructure.

Jaspersoft has released patches addressing this vulnerability: apply Hotfix 9 (HF-9) for installations running version 9.0.0 and later, and Hotfix 10 (HF-10) for installations running version 10.0.0 and later. Organizations should prioritize patching immediately given the unauthenticated, network-exploitable nature of the vulnerability. As interim mitigations, consider implementing network-level controls to restrict access to JasperReports Server XML-processing endpoints, disabling XML external entity resolution at the application or JVM level if feasible, and placing the server behind a WAF configured to block XXE payloads (Jaspersoft Advisory, GitHub Advisory).

Jaspersoft published an official security advisory on August 5–10, 2026, disclosing the vulnerability and providing hotfix guidance. CISA's ADP team assessed the vulnerability as automatable with total technical impact, though no active exploitation was noted at time of disclosure. A Tenable Nessus detection plugin (ID 335013) was published on August 18, 2026, enabling automated scanning for the vulnerability (Feedly, Jaspersoft Advisory).