Which versions of JasperReports Server are affected by EUVD-2026-55694?

JasperReports Server instances running versions 9.0.0 or 10.0.0 are vulnerable to remote, unauthenticated XML injection attacks that enable attackers to extract sensitive files and gain unauthorized…

How to fix or mitigate EUVD-2026-55694?

Within 24 hours, create an inventory of all JasperReports Server instances running versions 9.0.0 or 10.0.0 and immediately isolate them from untrusted networks using firewall rules or network segmentation; prioritize any internet-facing instances for immediate offline status if not business-critical. Within 7 days, deploy hotfix HF-9 for JasperReports Server 9.0.0 instances and hotfix HF-10 for version 10.0.0 instances as they become available from TIBCO, or upgrade to patched versions; concurrently implement Web Application Firewall rules configured to block XXE attack patterns and enable strict XML validation. Within 30 days, complete full remediation across all affected instances and restore normal network access once patching is confirmed; establish enhanced monitoring for exploitation attempts and conduct forensic review of server logs to identify any prior unauthorized access or data exfiltration.

JasperReports Server EUVD-2026-55694

Q: What is the CVSS score of EUVD-2026-55694?

EUVD-2026-55694 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-16626 CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2026-08-10 Jaspersoft

GHSA-p2q7-r6vq-359j

XXE Jasperreports Server

9.3

CVSS 4.0 · Vendor: Jaspersoft

Severity by source

Vendor (Jaspersoft) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Unauthenticated network XXE gives PR:N/AC:L; primary impact is file disclosure (C:H) with SSRF reaching other systems (S:C) and limited integrity/availability effects (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (Jaspersoft).

CVSS VectorVendor: Jaspersoft

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 18:37 vuln.today

CVE Published

Aug 10, 2026 - 18:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.

This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

AnalysisAI

Unauthenticated XML External Entity (XXE) injection in TIBCO/Jaspersoft JasperReports Server (9.0.0 before HF-9 and 10.0.0 before HF-10) allows a remote attacker to submit crafted XML that the server's parser resolves, enabling local file disclosure and server-side request forgery against internal systems. The vendor rates it CVSS 4.0 9.3 (Critical) and no authentication is required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach JasperReports XML endpoint

Delivery

Submit XML with external entity/DTD

Exploit

Parser resolves attacker-controlled entity

Execution

Read local files or SSRF internal hosts

Impact

Exfiltrate secrets or pivot