GRASSMARLIN EUVD-2026-26135

Exploitation requires three specific conditions: (1) the attacker must possess valid GRASSMARLIN login credentials (authenticated access, not default anonymous); (2) the attacker must have local access to the GRASSMARLIN system or a network path allowing session file upload/import - remote exploitation is not possible via network protocols alone; (3) the GRASSMARLIN session import or XML parsing feature must be enabled and accessible to the authenticated user (this is a default feature based on the description of 'session data' handling, but confirm in vendor advisory whether admins can disable it). No special non-default configuration is required - standard GRASSMARLIN installations with XML session support are vulnerable if a user with login credentials can reach the session import function.

CVSS score of 5.5 combined with local attack vector (AV:L) and low privileges required (PR:L) indicates moderate real-world risk limited to authenticated users on the same system. EPSS data not provided in input. The vulnerability is not listed as actively exploited in CISA KEV at time of analysis, and no public exploit code is referenced. However, XXE vulnerabilities are well-understood attack patterns with freely available exploitation techniques, making POC development trivial for threat actors with access. The high confidentiality impact (C:H) suggests exposure of authentication tokens, configuration data, or network credentials stored in XML configuration or session files. Risk is concentrated in air-gapped or hybrid ICS networks where GRASSMARLIN is deployed; enterprise IT networks using GRASSMARLIN for ICS situational awareness face elevated risk if user accounts are compromised. The limitation to authenticated local access significantly reduces attack surface compared to remote XXE variants.

An authenticated GRASSMARLIN user (or attacker who has compromised a valid account) crafts a malicious session export file containing XXE payloads such as '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>' embedded in XML session data. Upon importing this file through the session management interface, the XML parser processes the entity declaration and returns the contents of /etc/passwd or other sensitive files in error messages or logs visible to the attacker. The attacker extracts credentials, API keys, or network architecture data from the exposed files.