CVE-2026-14304

MEDIUM 5.5CVE-2026-14304 · Published 05/08/2026 · updated 23/10/2026

In short

CVE-2026-14304 is a MEDIUM (CVSS 5.5) vulnerability affecting accessibility tools framework (eclipse), michecker (soumu).
Chance of exploitation in the next 30 days (EPSS): 0.23%, higher than 13.7% of all vulnerabilities.
Fix: update to 3.2.0 or later.

Package	Affected versions	Patched versions
accessibility tools framework eclipse	`≥ 0.5.0, ≤ 1.6.0`	No fix yet
michecker soumu	`< 3.2.0`	`3.2.0`

Description

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.

References

eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html · Vendor Advisory
eclipse-actf/org.eclipse.actf · Product
gitlab.eclipse.org/security/cve-assignment/-/work_items/151 · Vendor Advisory
soumu.go.jp/info-accessibility-portal/webaccessibility/michecker · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free