Vulnerability · Published Nov 5, 2026 · Assigned by mitre
CVE-2026-123029
High 7.5
In plain English
A high-severity XML external entity in Streaming Engine from Wowza. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 66.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wowza | Streaming Engine | 0 – before 4.12.2 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.wowza.com/docs/xxe-allows-reading-local-files vendor-advisory