EIP-2026-119684

PRE-CVE

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-119684. PoCs published by SEC Consult.

AI-analyzed exploit summary This advisory details an XML External Entity Injection (XXE) vulnerability in RSA Enterprise Compromise Assessment Tool (ECAT) version 4.1.0.1, allowing attackers to read files and perform internal network scans by tricking users into importing a malicious XML whitelisting file.

Description

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection

Exploits (1)

exploitdb WRITEUP
by SEC Consult · textwebappsxml
https://www.exploit-db.com/exploits/40501

This advisory details an XML External Entity Injection (XXE) vulnerability in RSA Enterprise Compromise Assessment Tool (ECAT) version 4.1.0.1, allowing attackers to read files and perform internal network scans by tricking users into importing a malicious XML whitelisting file.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: RSA Enterprise Compromise Assessment Tool (ECAT) 4.1.0.1
No auth needed
Prerequisites: User interaction to import a malicious XML file
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026