CVE-2015-6096: Microsoft .NET Framework XML DTD parser XXE file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw allows unauthenticated remote file disclosure in a widely deployed framework and has a very high EPSS score, though it is not in KEV and requires medium access complexity.

What it is

The XML DTD parser in Microsoft .NET Framework versions 2.0 SP2 through 4.6 resolves external entity declarations, allowing an XML External Entity (XXE) attack. A remote attacker who can supply XML to a vulnerable application can cause the parser to read local files and disclose their contents, which matters because .NET XML parsing is widely used in server-side and client-side code.

Impact

An attacker gains read access to arbitrary files on the host running the vulnerable .NET application, potentially exposing configuration files, credentials or other sensitive data. The CVSS 2.0 vector shows partial confidentiality impact only, with no integrity or availability effect.

Attack surface

Reached over the network (AV:N) by submitting crafted XML containing an external entity declaration and entity reference to an application that parses it with the affected .NET XML DTD parser. No authentication is required (Au:N), but the vector indicates medium access complexity (AC:M), implying some conditions such as a reachable parsing path or crafted input delivery.

Exploitation

Not listed in CISA KEV and no reference tags indicate public exploit code, but EPSS is high at 0.61 probability (99th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply the Microsoft MS15-118 security update for the affected .NET Framework versions.
• Disable DTD processing and external entity resolution in XML parsers (for example, set XmlReaderSettings DtdProcessing to Prohibit and XmlResolver to null).
• Avoid passing untrusted XML to the .NET XML DTD parser; validate or sanitize XML input at trust boundaries.
• Upgrade to a supported .NET Framework version that includes the fix, since the listed versions are long out of support.

Detection

• Search application and web server logs for XML requests containing DOCTYPE or ENTITY declarations, especially SYSTEM or file:// references.
• Monitor for outbound or local file access patterns from XML parsing processes that read unexpected files such as web.config or system files.
• Use endpoint or file integrity monitoring to alert on reads of sensitive configuration files by .NET application processes.
• Review code and static analysis findings for XmlReader, XmlDocument or XDocument usage with DTD processing enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.