CVE-2026-6807

NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

CVSS 5.5 MEDIUMEPSS 0.2%CWE-611

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

28 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

NSA · GRASSMARLIN

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-118-01.json https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01