---
id: CVE-2026-19596
title: >-
  An XML External Entity (XXE) vulnerability exists in the XML collector of
  multiple versions of OpenNMS Meridian and Horizon
summary: >-
  An XML External Entity (XXE) vulnerability exists in the XML collector of
  multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML
  from a source whose response is attacker-controlled (for example a compromised
  monitor…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-611
vendor: The OpenNMS Group
product: Meridian
affected:
  - Meridian >= 2024.1.0 < 2024.3.13
  - Meridian >= 2025.0.0 < 2025.0.10
  - Horizon >= 36.0.0 < 36.0.4
published: '2026-09-10'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:21:34.307'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19596'
references:
  - url: 'https://github.com/OpenNMS/opennms/pull/8782'
    label: security@opennms.com
tags:
  - nvd
  - cve.org
epss: 0.00211
epssPercentile: 0.10153
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T20:27:39.274555Z'
ingestedAt: '2026-09-12T22:59:59.285Z'
---

## Overview

An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector's XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests.



The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.