CVE-2020-27858: CA Arcserve D2D getNews XXE allows unauthenticated file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable XXE with high confidentiality impact and very high EPSS, though not in KEV and no confirmed in-the-wild exploitation is documented.

What it is

CA Arcserve D2D 16.5 contains an XML External Entity (XXE) flaw in the getNews method. Because the XML parser resolves external entity references without restriction, a crafted document can make the parser fetch a URI and embed its contents into the processed XML. The flaw is remotely reachable without authentication and can expose sensitive data.

Impact

An attacker can read files and other resources accessible to the affected service, which runs in the SYSTEM context, so disclosed data may include highly privileged system files. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via the getNews functionality with no authentication and no user interaction required, per the CVSS vector AV:N/PR:N/UI:N. The description does not specify the exact port or endpoint, so defenders must identify the service path themselves.

Exploitation

Not listed in CISA KEV and no public exploit references are included beyond the ZDI advisory; EPSS is high at roughly 0.738 (99.5th percentile), indicating elevated predicted exploitation likelihood.

What to do

• Apply the vendor fix for CA Arcserve D2D 16.5 or upgrade to a supported release; patch first.
• Disable external entity and DTD processing in the XML parser used by getNews if configuration allows.
• Restrict network access to the D2D service so only trusted management hosts can reach it.
• Run the D2D service under a least-privilege account rather than SYSTEM to limit file disclosure scope.
• Monitor vendor advisories for updated guidance since the record lists no fixed version.

Detection

• Inspect HTTP requests to the getNews endpoint for XML bodies containing DOCTYPE or ENTITY declarations.
• Alert on outbound connections from the D2D host to unexpected internal or external URIs, which may indicate entity resolution.
• Review D2D service logs for XML parsing errors or unusual file access patterns around getNews calls.
• Baseline normal getNews traffic and flag anomalous request sizes or content types.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.