CVE-2026-8396

Full vulnerability record from the local CVENow database.

Description

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-07-17 13:19:01.827000

Last modified

2026-10-24 20:10:00.137000

View original CVE JSON

{
  "id": "CVE-2026-8396",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-17T13:19:01.827",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking.\n\nThis issue affects NetGIS: from 5.0.66 before 7.2.2."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de restricción inadecuada de referencia a entidad externa XML en Netcad Software Inc. NetGIS permite el enlace externo de datos serializados.\n\nEste problema afecta a NetGIS: desde 5.0.66 antes de 7.2.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Netcad Software Inc.",
          "product": "NetGIS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.0.66",
              "lessThan": "7.2.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T12:54:54.239036Z",
          "id": "CVE-2026-8396",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0570",
      "source": "[email protected]"
    }
  ]
}