Vulnerability · Published Aug 5, 2026 · Assigned by eclipse

CVE-2026-14304

Medium 4.6

In plain English

A medium-severity XML external entity in Eclipse Accessibility Tools Framework (ACTF) from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 4.0)4.6Medium

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.

Affected products (as reported)

Vendor	Product	Versions
Eclipse Foundation	Eclipse Accessibility Tools Framework (ACTF)	0.5.0 – through 1.6.00 – through v20260630

Weakness: CWE-611 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References