CVE-2021-23926: Apache Xmlbeans

Critical severity, CVSS 9.1. EPSS: 6.3% chance of exploitation in the next 30 days.

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Affected products

• Apache Xmlbeans: up to and including 2.6.0
• Debian Debian Linux: version 9.0 only
• Netapp Oncommand Unified Manager Core Package: affected versions not specified
• Netapp Snap Creator Framework: affected versions not specified
• Netapp Snapmanager: affected versions not specified
• Oracle Middleware Common Libraries And Tools: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only

Published 2021-01-14. Last modified 2026-06-17.