CISA flags data-theft bug in NSA-built OT networking tool

CISA warned that GrassMarlin (an NSA open-source tool) contains an XXE vulnerability (CVE-2026-6807) that can disclose sensitive data; the project went EOL in 2017 so no patch is forthcoming. A Rapid7 researcher published a public proof-of-concept showing out-of-band exfiltration is possible by crafting malicious session XML files, though exploitation is constrained by required Java versions, error conditions, and realistic delivery via phishing. CISA recommends isolating control systems from the internet and securing remote access.