CVE-2026-16626 — JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

CVE-2026-16626

JasperReports Server: XXE Injection Vulnerability (Unauthenticated) PUBLISHED

Description (CNA)

Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.

Affected (CNA)

Vendor / product	Versions
Jaspersoft / JasperReports Server	affected 9.0.0 before HF-9; affected 10.0.0 before HF-10

CWE

CWE-611

References

https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-august-05-2026-jasperreports-server-cve-2026-16626-r12/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.