Episerver 7 - XXE (CVE-2017-17762)

CVE-2017-17762 is an XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier, which allows remote attackers to read arbitrary files on the server by submitting maliciously crafted XML requests to util/xmlrpc/Handler.ashx. This flaw could be exploited to access sensitive information, potentially leading to further attacks or data breaches.

CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.

CrowdSec network data shows that most actors exploiting CVE-2017-17762 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2017-17762 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2017-17762 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by sending crafted XML payloads to the /util/xmlrpc/Handler.ashx endpoint, attempting to trigger XML External Entity (XXE) processing for unauthorized file access or external resource loading.