XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page com…

published 2026-07-27 3 mo ago modified 2026-07-27 3 mo ago also EUVD-2026-49062

cvss: 8.2; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

Patch / fix

distros 5

red hat suse opensuse almalinux rocky linux

xmlrpc-c RHEL 8 1.51.0-11.el8_10.1
xmlrpc-c-c++ RHEL 8 1.51.0-11.el8_10.1
xmlrpc-c-client RHEL 8 1.51.0-11.el8_10.1
xmlrpc-c-client++ RHEL 8 1.51.0-11.el8_10.1
xmlrpc-c RHEL 9 1.51.0-17.el9_8
xmlrpc-c-c++ RHEL 9 1.51.0-17.el9_8
xmlrpc-c-client RHEL 9 1.51.0-17.el9_8
xmlrpc-c-client++ RHEL 9 1.51.0-17.el9_8

red hat advisories RHSA-2026:64772 RHSA-2026:61316 RHSA-2026:61315 RHSA-2026:61236 RHSA-2026:61234 RHSA-2026:61235

xmlrpc-c SLES for SAP applications 16.0, SLES 16.0 1.54.06-160000.3.1
xmlrpc-c SLE Module for Package Hub 15 SP7, SLE Module for Basesystem 15 SP7 1.51.07-150400.3.3.1

suse advisories SUSE-SU-2026:23311-1 SUSE-SU-2026:3572-1

xmlrpc-c openSUSE Leap 16.0 1.54.06-160000.3.1
xmlrpc-c openSUSE Tumbleweed 1.64.03-2.1

opensuse advisories openSUSE-SU-2026:21633-1 openSUSE-SU-2026:11409-1

xmlrpc-c AlmaLinux 8 1.51.0-11.el8_10.1
xmlrpc-c-c++ AlmaLinux 8 1.51.0-11.el8_10.1
xmlrpc-c-client AlmaLinux 8 1.51.0-11.el8_10.1
xmlrpc-c-client++ AlmaLinux 8 1.51.0-11.el8_10.1
xmlrpc-c AlmaLinux 9 1.51.0-17.el9_8
xmlrpc-c-c++ AlmaLinux 9 1.51.0-17.el9_8
xmlrpc-c-client AlmaLinux 9 1.51.0-17.el9_8
xmlrpc-c-client++ AlmaLinux 9 1.51.0-17.el9_8

almalinux advisories ALSA-2026:64772 ALSA-2026:61316

xmlrpc-c Rocky Linux 8 1.51.0-11.el8_10.1
xmlrpc-c Rocky Linux 9 1.51.0-17.el9_8

rocky linux advisories RLSA-2026:64772 RLSA-2026:61316

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-15928 updated 2026-11-04 cvss 7.4

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

Red Hat Enterprise Linux 6 xmlrpc-c-c++, xmlrpc-c-apps, xmlrpc-c-client, xmlrpc-c-client++, xmlrpc-c 1.16.24-1210.1840.el6
affected: workaround, no fix planned “Out of support scope”
Red Hat CodeReady Linux Builder EUS (v.9.6) xmlrpc-c-c++ 1.51.0-16.el9_6.1, xmlrpc-c-client++ 1.51.0-16.el9_6.1
fixed: vendor fix RHSA-2026:61315
Red Hat Enterprise Linux AppStream (v. 9) xmlrpc-c 1.51.0-17.el9_8, xmlrpc-c-client 1.51.0-17.el9_8
fixed: vendor fix RHSA-2026:61316
Red Hat Enterprise Linux AppStream E4S (v.9.2) xmlrpc-c 1.51.0-16.el9_2.1, xmlrpc-c-client 1.51.0-16.el9_2.1
fixed: vendor fix RHSA-2026:61231
Red Hat Enterprise Linux AppStream E4S (v.9.4) xmlrpc-c 1.51.0-16.el9_4.1, xmlrpc-c-client 1.51.0-16.el9_4.1
fixed: vendor fix RHSA-2026:61232
Red Hat Enterprise Linux AppStream EUS (v.9.6) xmlrpc-c 1.51.0-16.el9_6.1, xmlrpc-c-client 1.51.0-16.el9_6.1
fixed: vendor fix RHSA-2026:61315
Red Hat Enterprise Linux BaseOS (v. 8) xmlrpc-c 1.51.0-11.el8_10.1, xmlrpc-c-client 1.51.0-11.el8_10.1
fixed: vendor fix RHSA-2026:64772
Red Hat Enterprise Linux BaseOS AUS (v.8.4) xmlrpc-c 1.51.0-5.el8_4.3, xmlrpc-c-client 1.51.0-5.el8_4.3
fixed: vendor fix RHSA-2026:61236

show 8 more

Red Hat Enterprise Linux BaseOS AUS (v.8.6) xmlrpc-c 1.51.0-6.el8_6.2, xmlrpc-c-client 1.51.0-6.el8_6.2
fixed: vendor fix RHSA-2026:61233
Red Hat Enterprise Linux BaseOS E4S (v.8.8) xmlrpc-c 1.51.0-8.el8_8.2, xmlrpc-c-client 1.51.0-8.el8_8.2
fixed: vendor fix RHSA-2026:61235
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) xmlrpc-c 1.51.0-5.el8_4.3, xmlrpc-c-client 1.51.0-5.el8_4.3
fixed: vendor fix RHSA-2026:61236
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) xmlrpc-c 1.51.0-6.el8_6.2, xmlrpc-c-client 1.51.0-6.el8_6.2
fixed: vendor fix RHSA-2026:61233
Red Hat Enterprise Linux BaseOS TUS (v.8.8) xmlrpc-c 1.51.0-8.el8_8.2, xmlrpc-c-client 1.51.0-8.el8_8.2
fixed: vendor fix RHSA-2026:61235
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) xmlrpc-c-c++ 1.51.0-17.el9_8, xmlrpc-c-client++ 1.51.0-17.el9_8
fixed: vendor fix RHSA-2026:61316
Red Hat Enterprise Linux CRB (v. 8) xmlrpc-c-c++ 1.51.0-11.el8_10.1, xmlrpc-c-client++ 1.51.0-11.el8_10.1
fixed: vendor fix RHSA-2026:64772
Red Hat Enterprise Linux Server (v. 7 ELS) xmlrpc-c 1.32.5-1905.svn2451.el7_9.1, xmlrpc-c-client 1.32.5-1905.svn2451.el7_9.1 Red Hat Enterprise Linux Server Optional (v. 7 ELS) xmlrpc-c-c++ 1.32.5-1905.svn2451.el7_9.1, xmlrpc-c-apps 1.32.5-1905.svn2451.el7_9.1, xmlrpc-c-client++ 1.32.5-1905.svn2451.el7_9.1
fixed: vendor fix RHSA-2026:61234

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-27)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.2	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA	4.0	8.2	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

XMLRPC-C XMLRPC-C

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

xmlrpc-c.sourceforge.io /
vendor-advisory
themissinglink.com.au /security-advisories/cve-2026-15928
third-party-advisory

Sources

CVE List CVE-2026-15928
NVD CVE-2026-15928

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary