CVE-2026-14304
Full vulnerability record from the local CVENow database.
Description
In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.
Severity
MEDIUM
CVSS score
4.6
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-05 11:16:24.887000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-14304",
"sourceIdentifier": "[email protected]",
"published": "2026-08-05T11:16:24.887",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists.\n\n\n\nIf this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker."
},
{
"lang": "es",
"value": "En las versiones de Eclipse Accessibility Tools Framework (ACTF) hasta la 1.6.0 (incluyendo las versiones de código fuente hasta la v20260630 y las versiones de la aplicación miChecker basada en ACTF hasta la 3.1.0), se ha identificado que existe una vulnerabilidad de Entidad Externa XML (XXE).\n\nSi esta vulnerabilidad es explotada, un tercero malintencionado podría obtener acceso a recursos locales o recursos de red internos a través de computadoras que ejecutan aplicaciones que utilizan Eclipse ACTF, incluyendo miChecker."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Eclipse Foundation",
"product": "Eclipse Accessibility Tools Framework (ACTF)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.5.0",
"lessThanOrEqual": "1.6.0",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThanOrEqual": "v20260630",
"versionType": "git",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-05T13:03:48.752239Z",
"id": "CVE-2026-14304",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-611"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:accessibility_tools_framework:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.5.0",
"versionEndIncluding": "1.6.0",
"matchCriteriaId": "300F91D3-CAAE-4D2A-BA7C-D1C3D4CACD2D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:soumu:michecker:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0",
"matchCriteriaId": "7BAF9066-1B9B-4AF8-9196-FB346310AEB4"
}
]
}
]
}
],
"references": [
{
"url": "https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://github.com/eclipse-actf/org.eclipse.actf",
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.soumu.go.jp/info-accessibility-portal/webaccessibility/michecker/",
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}