{"action":"Upgrade io.openremote:openremote-agent to 1.24.2 or later.","affected":[{"fixed":"1.24.2","introduced":"0"}],"component":"io.openremote:openremote-agent","cve_ids":["CVE-2026-54640"],"ecosystem":"Maven","epss":0.00219,"exploited":false,"fixed_versions":["1.24.2"],"ghsa_id":"GHSA-7v6w-c3f4-9wpq","id":"tcs_01M5N8K6ZVGV8AF6GMGSEA2CP0","modified_at":"2026-07-06T21:11:32.012240Z","published_at":"2026-07-06T20:49:51Z","references":["https://osv.dev/vulnerability/GHSA-7v6w-c3f4-9wpq","https://github.com/openremote/openremote/security/advisories/GHSA-7v6w-c3f4-9wpq","https://github.com/openremote/openremote/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9","https://github.com/openremote/openremote"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-7v6w-c3f4-9wpq","url":"https://osv.dev/vulnerability/GHSA-7v6w-c3f4-9wpq"}],"summary":"OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory"}