CVE-2026-84941 MEDIUM

CVE-2026-84941: Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

Vendor Tp-Link Systems Inc.
Product Omada Software Controller (Windows)
Weakness CWE-611 · XXE
Published September 10, 2026
Last update September 10, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

Key dates

02Disclosure timeline

September 10, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2025-14478 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload CVE-2024-50442 WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8 CVE-2025-31039 WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability CVE-2025-32138 WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability