Which versions of JasperReports Server are affected by CVE-2026-16626?

JasperReports Server instances running versions 9.0.0 or 10.0.0 are vulnerable to remote, unauthenticated XML injection attacks that enable attackers to extract sensitive files and gain unauthorized…

How to fix or mitigate CVE-2026-16626?

Within 24 hours, create an inventory of all JasperReports Server instances running versions 9.0.0 or 10.0.0 and immediately isolate them from untrusted networks using firewall rules or network segmentation; prioritize any internet-facing instances for immediate offline status if not business-critical. Within 7 days, deploy hotfix HF-9 for JasperReports Server 9.0.0 instances and hotfix HF-10 for version 10.0.0 instances as they become available from TIBCO, or upgrade to patched versions; concurrently implement Web Application Firewall rules configured to block XXE attack patterns and enable strict XML validation. Within 30 days, complete full remediation across all affected instances and restore normal network access once patching is confirmed; establish enhanced monitoring for exploitation attempts and conduct forensic review of server logs to identify any prior unauthorized access or data exfiltration.

JasperReports Server CVE-2026-16626

Q: What is the CVSS score of CVE-2026-16626?

CVE-2026-16626 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-55694 CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2026-08-10 Jaspersoft

GHSA-p2q7-r6vq-359j

XXE Jasperreports Server Jaspersoft

9.3

CVSS 4.0 · Vendor: Jaspersoft

Severity by source

Vendor (Jaspersoft) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Unauthenticated network XXE gives PR:N/AC:L; primary impact is file disclosure (C:H) with SSRF reaching other systems (S:C) and limited integrity/availability effects (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (Jaspersoft).

CVSS VectorVendor: Jaspersoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 18:37 vuln.today

CVE Published

Aug 10, 2026 - 18:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.

This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

AnalysisAI

Unauthenticated XML External Entity (XXE) injection in TIBCO/Jaspersoft JasperReports Server (9.0.0 before HF-9 and 10.0.0 before HF-10) allows a remote attacker to submit crafted XML that the server's parser resolves, enabling local file disclosure and server-side request forgery against internal systems. The vendor rates it CVSS 4.0 9.3 (Critical) and no authentication is required. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated network vector makes it a high-priority patch.

Technical ContextAI

JasperReports Server is a Java-based business-intelligence and reporting platform that ingests and processes XML in multiple places (report definitions, configuration, SOAP/REST payloads, and report input controls). The root cause is CWE-611, Improper Restriction of XML External Entity Reference: an XML parser is configured to resolve external entities and DTDs supplied by the requester. When external entity resolution is enabled, an attacker-supplied DOCTYPE/entity can force the server to read local files (e.g. via file:// URIs) or issue outbound requests (SSRF via http:// URIs), and can also be abused for denial-of-service through entity expansion. The affected component is identified by CPE cpe:2.3:a:jaspersoft:jasperreports_server, and the advisory attributes discovery to Jaspersoft itself.

RemediationAI

Vendor-released patch: apply HF-9 for the 9.0.0 branch and HF-10 for the 10.0.0 branch as documented in the Jaspersoft Security Advisory of August 5, 2026 (https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-august-05-2026-jasperreports-server-cve-2026-16626-r12/); upgrading to these hotfix levels is the primary and definitive fix. If immediate patching is not possible, reduce exposure by restricting network access to the JasperReports Server web/SOAP/REST endpoints so they are reachable only from trusted management networks or behind a VPN, and place a reverse proxy or WAF rule in front to reject XML payloads containing DOCTYPE/ENTITY declarations (note this can break legitimate integrations that submit DTD-bearing XML). Additionally, egress-filter the server so it cannot make outbound connections to internal services or the internet, which blunts the SSRF and out-of-band data-exfiltration paths (trade-off: may interfere with legitimate external data sources or callbacks the reports rely on). These are compensating controls only - schedule the hotfix promptly.