View Ridge Security
Back to Cyber Hose

Omada Controller XXE in SAML metadata parsing enables local file read

TP-Link Omada Controller XXE vulnerability headlines this digest, alongside an Indonesian banking app-cloning campaign and a Netskope kernel overflow flaw.

🕵️ RESEARCH & DEEP DIVES

  • Omada Controller XXE in SAML metadata parsing enables arbitrary local file read (CVE-2026-84941)
    TP-Link's Omada Controller has an XXE information disclosure vulnerability in its SAML SSO metadata parsing.

    • Affects Omada Controller versions before 6.2.14.11 and multiple component builds before 11 Build 20260711
    • Authenticated users with SAML configuration privileges can exploit XXE (CWE-611) via user-supplied SAML metadata
    • Allows arbitrary local file read and unauthorized disclosure of sensitive information
    • CVSS 4.0 score 6.9 (Medium); fixed in updates available via TP-Link's Omada download page
    Sources 📄 Source: support.omadanetworks.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

  • Indonesia Hit by Android Banking App-Cloning Campaign — Dark Reading

  • AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution ... — CVE ThreatInt

  • [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account ChecksConcrete... — CVE ThreatInt

  • Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption,... — CVE ThreatInt

  • OS command injection Vulnerability in Deco BE11000An OS command injection vul... — CVE ThreatInt

  • Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow... — CVE ThreatInt

  • Attack strategies from wild hackers/bots, shareable? — r/cybersecurity

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check