CVE-2026-47898 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-47898 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-47898 is an XML External Entity (XXE) injection vulnerability in Apache Lucene.Net, specifically within the Lucene.Net.Analysis.Common library, affecting all versions from 4.8.0-beta000 onward.

Technical Detail

The flaw stems from improper restriction of XML external entity references within the Lucene.Net.Analysis.Common component, meaning the library processes user-influenced XML input without disabling external entity resolution. An attacker who can supply or influence XML data processed by this library may be able to trigger server-side request forgery (SSRF), read arbitrary files from the host filesystem, or in some configurations achieve remote code execution depending on the application's XML parser configuration and runtime environment. The CVSS score of 9.8 reflects the potential for unauthenticated, network-accessible exploitation with high impact to confidentiality, integrity, and availability.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as none, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. This status should be monitored closely given the critical severity rating and the broad use of Apache Lucene.Net in search-enabled .NET applications.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability as of July 10, 2026.

What To Do

Organizations using Apache Lucene.Net.Analysis.Common at version 4.8.0-beta000 or later should treat this as a priority patch given the critical CVSS score. Monitor the Apache Lucene.Net project's official release channels and security advisories for a patched version and apply it as soon as one is available. As an interim measure, review all application code that passes XML input into Lucene.Net.Analysis.Common components and enforce strict XML parser hardening by disabling external entity processing at the application level using parser-specific settings such as setting XmlReaderSettings.DtdProcessing to Prohibit in .NET environments. Restrict network egress from application servers to limit the impact of potential SSRF exploitation. Implement logging and alerting on anomalous outbound HTTP or file access patterns originating from search or analysis processing pipelines.