Apache Cocoon CVE-2026-108086

Exploitation requires that the target run Apache Cocoon with the fp: form processor feature in use and that an attacker can submit XML input to it; the parser must accept external/recursive DTD entity references (default XML parsing behavior absent explicit entity-expansion hardening). The product being retired means no patched version exists - the only limiting factors are deployment-level: whether the Cocoon instance and its form-processing endpoints are network-reachable and whether access has been restricted to trusted users (the vendor's recommended mitigation). Realistic risk is bounded primarily by the rarity of live Cocoon deployments rather than by authentication or configuration barriers.

Risk signals are largely absent from the input and must be reasoned from the description rather than confirmed data. No CVSS score or vector was provided (both N/A), no EPSS probability is available, there is no CISA KEV listing, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The sole reference is the Apache advisory mailing-list thread. The vulnerability itself is technically serious: an XML entity expansion (XEE) flaw in the fp: form processor that can be driven to SSRF and server-side file exposure to an untrusted external system, which on paper implies a network-reachable, likely unauthenticated attack with a scope change (file disclosure crossing a trust boundary). However, the dominant mitigating factor is that Apache Cocoon is explicitly RETIRED and UNSUPPORTED - the advisory states all versions are affected and NO fix will ever be released, with the vendor recommending migration or access restriction. This combination (high technical impact but a dead, low-footprint product with no exploitation evidence) makes it a targeted/legacy-exposure concern rather than a broad, high-urgency priority. CRITICAL CAVEAT: there is no input CVSS vector, so attack vector, complexity, and privilege requirements are INFERRED from the description only and should be verified against the Apache advisory before operational prioritization.

An attacker submits a crafted XML document to a Cocoon fp: (form processor) endpoint containing recursive/external DTD entity references. During parsing, the entity expansion forces the server to fetch and return internal resources, enabling SSRF and disclosure of local server files to the attacker-controlled external system. No public exploit code is referenced, and the attack appears network-reachable without special credentials based on the description, though this is not confirmed by a CVSS vector.