Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119724— Apache JClouds: XML External Entity (XXE) in provider-response parsing

Quick assessment

Affected
Apache Software Foundation Apache JClouds
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

分配时不受支持：Apache JClouds 中存在 DTD 中递归实体引用限制不当（即"XML 实体扩展”）漏洞。 该问题影响 Apache JClouds 的所有版本。 由于该项目已停止维护，我们计划不再发布修复此问题的新版本。建议用户寻找替代方案，或将实例访问权限限制为仅限可信用户。 注意：此漏洞仅影响维护者已不再支持的产品。

AI Predicted 9.8 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119724

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache JClouds: XML External Entity (XXE) in provider-response parsing
Source: CVE Program / CVE List V5
Vulnerability Description
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
DTD中递归实体索引的不恰当限制(XML实体扩展)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache JClouds 0 ~ * -

II. Public POCs for CVE-2026-119724

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119724

请登录查看更多情报信息。

Other References for CVE-2026-119724 (1)

Same Patch Batch · Apache Software Foundation · 2026-11-03 · 3 CVEs total

CVE-2026-114442 Apache HertzBeat: incomplete XPath expression validation in aliasFields
CVE-2026-119641 Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership

IV. Related Vulnerabilities

Same product: Apache JClouds
Same vendor: Apache Software Foundation
Same weakness: CWE-776