CVE-2026-14304 is an XML External Entity (XXE) vulnerability in Eclipse ACTF (Accessibility Tools Framework), affecting versions up to and including 1.6.0. The flaw exists in how ACTF parses XML documents during accessibility compliance checks—external entity processing was not disabled in the XML parser configuration, allowing an attacker to inject malicious entity references that can read local files or trigger server-side request forgery.
If you run ACTF in your environment, verify you are on version 1.6.1 or later. However, patching alone may be insufficient. The more important question is what ACTF was processing: this is a compliance tool designed to handle accessibility documentation, which frequently includes disability accommodation records, medical documentation, and assistive technology configurations. The CVSS 5.5 score severely understates the real impact if your workflows involve sensitive employee or applicant data—the blast radius extends to protected information you may have compliance obligations around.
Beyond version checking, confirm the patch actually removed the vulnerable parsing code rather than just disabling external entities as a configuration change. If ACTF maintains multiple XML parsing pathways for different document formats or legacy compatibility, verify all branches were hardened. Deprecated code paths that still compile represent dormant risk—future refactoring could inadvertently reactivate them.
The systemic lesson: XML parsers in most languages historically shipped with XXE enabled by default, and framework developers frequently integrated them without explicit security configuration. When evaluating any tool that parses XML from external or untrusted sources, explicitly verify that entity expansion limits are set and external entity access is disabled regardless of what the documentation claims. The assumption that a parser's defaults are secure has repeatedly proven false.