CVE-2026-84941
Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
| CWE | CWE-611 |
| Vendor | tp-link systems inc. |
| Product | omada software controller (windows) |
| Published | Sep 10, 2026 |
| Last Updated | Sep 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for tp-link systems inc. omada software controller (windows)
Be the first to know when new unknown vulnerabilities affecting tp-link systems inc. omada software controller (windows) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TP-Link Systems Inc. / Omada Software Controller (Windows)
0 < 6.2.14.11
TP-Link Systems Inc. / Omada Software Controller (Linux)
0 < 6.2.14.11
TP-Link Systems Inc. / OC2000 v1
0 < 1.41.11 Build 20260711
TP-Link Systems Inc. / OC2000 v2
0 < 2.26.11 Build 20260711
TP-Link Systems Inc. / OC200 v3
0 < 3.3.11 Build 20260711
TP-Link Systems Inc. / OC220 v1
0 < 1.6.11 Build 20260711
TP-Link Systems Inc. / OC220 v2
0 < 2.5.11 Build 20260711
TP-Link Systems Inc. / OC300 v1
0 < 1.35.11 Build 20260711
TP-Link Systems Inc. / OC400 v1
0 < 1.13.11 Build 20260711
References
support.omadanetworks.com: https://support.omadanetworks.com/en/download/software/omada-controller support.omadanetworks.com: https://support.omadanetworks.com/us/download/software/omada-controller omadanetworks.com: https://www.omadanetworks.com/en/support/download/ omadanetworks.com: https://www.omadanetworks.com/us/support/download/ support.omadanetworks.com: https://support.omadanetworks.com/en/document/133722/
Credits
erikdejong mattgsys eslam moneer (tohtmosiii)