What is the CVSS score of CVE-2026-8396?

CVE-2026-8396 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Netcad NetGIS are affected by CVE-2026-8396?

Netcad Software NetGIS versions 5.0.66 through 7.2.1 contain an XML External Entity (XXE) vulnerability that enables remote attackers to read sensitive files and access internal network resources.. A patch is available.

How to fix or mitigate CVE-2026-8396?

Within 24 hours: Conduct a complete inventory of all systems running NetGIS versions 5.0.66 through 7.2.1 and document network exposure points; implement firewall rules to restrict network access to NetGIS services from untrusted sources; establish an incident response readiness plan. Within 7 days: Disable XML external entity processing in NetGIS application configuration if your version supports it; deploy Web Application Firewall rules to block XXE payloads; begin change control process to plan upgrade to NetGIS 7.2.2 or later. Within 30 days: Execute the upgrade to NetGIS 7.2.2 or later to resolve the vulnerability; validate the upgrade in non-production environments first; implement application-level input validation for all XML processing and enable XML signature verification where supported.

Netcad NetGIS CVE-2026-8396

EUVD-2026-45165 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-07-17 TR-CERT

GHSA-wrw3-44cj-hmrf

XXE Netgis

7.5

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated XML submission with low complexity yields file/internal-data disclosure (C:H); no integrity or availability impact, scope kept unchanged absent confirmed SSRF pivot.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 17, 2026 - 15:03 EUVD

Analysis Generated

Jul 17, 2026 - 13:05 vuln.today

CVE Published

Jul 17, 2026 - 12:20 cve.org

HIGH 7.5

DescriptionCVE.org

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking.

This issue affects NetGIS: from 5.0.66 before 7.2.2.

AnalysisAI

Sensitive file and internal resource disclosure in Netcad Software NetGIS (versions 5.0.66 up to but not including 7.2.2) arises from an XML External Entity (XXE) flaw where the application resolves external entity references in serialized/XML data submitted by clients. Remote attackers can craft malicious XML payloads to read local files, exfiltrate data, or reach internal network resources on the server. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Turkey's national CERT (TR-CERT/USOM).

Technical ContextAI

NetGIS is a geographic information system (GIS) product from the Turkish vendor Netcad Software Inc. The vulnerability is a classic XML External Entity injection (CWE-611: Improper Restriction of XML External Entity Reference). It occurs when an XML parser processing serialized data is configured to resolve external entities (DOCTYPE/SYSTEM declarations) instead of disabling them. GIS platforms routinely ingest structured/serialized formats (e.g., GML, KML, SOAP, XM'-based map/feature exchange), which makes an XML deserialization path a plausible attack surface. The CPE cpe:2.3:a:netcad_software_inc.:netgis:*:*:*:*:*:*:*:* confirms the affected component is the NetGIS application itself across all editions in the vulnerable range. Because external entities can point at 'file://' URIs or internal 'http(s)://' endpoints, XXE typically yields arbitrary file read and server-side request forgery (SSRF)-style internal access.

RemediationAI

Upgrade NetGIS to version 7.2.2 or later, which is the first release outside the affected range (Vendor-released patch: 7.2.2). If immediate upgrade is not feasible, apply compensating controls at the XML-processing layer: disable DTD processing and external entity/parameter-entity resolution in the parser (the definitive XXE fix), which generally has no functional side effect for data that does not legitimately use DTDs; restrict or block the server's outbound network access so 'file://' and internal 'http://' entity fetches fail (trade-off: may break legitimate remote schema/resource fetches); and place NetGIS XML-ingestion endpoints behind authentication or network ACLs to limit which clients can submit serialized data (trade-off: reduces exposure but does not remediate the parser flaw). Refer to the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0570 for vendor guidance.