Vulnerability · Published Apr 28, 2026 · Assigned by icscert
CVE-2026-6807NSA GRASSMARLIN Improper Restriction of XML External Entity Reference
Medium 5.5
In plain English
A medium-severity XML external entity in GRASSMARLIN from NSA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NSA | GRASSMARLIN | All versions |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N