Is CVE-2023-45727 (North Grid Proself Improper Restriction of XML External Entity (XXE) Reference) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-45727 to its Known Exploited Vulnerabilities catalogue on 3 December 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.

What “exploited in the wild” means for CVE-2023-45727

For this CVE, the practical answer is about exploitation status, not just the weakness description. CISA’s KEV inclusion means there is reliable evidence of active abuse, so defenders should treat this as a real exploitation case, not a theoretical XXE issue. The vendor and the KEV catalogue are the authoritative places for version and remediation details.

XXE matters because it can let a remote unauthenticated attacker coerce the application into processing attacker-controlled XML references. In a product like North Grid Proself, that can create exposure well beyond simple parsing errors, including unexpected file access, outbound requests, or other trust-boundary violations depending on how XML is handled.

The most useful first question is whether the affected Proself components are exposed in a way that still allows XML parsing paths to be reached from untrusted input. If they are internet-facing or reachable from semi-trusted zones, treat them as higher priority because exploited XXE often becomes an initial foothold rather than a standalone bug.

For broader exploitation context and response planning, Zero-Day and Exploited Vulnerabilities Guide is the best internal starting point for KEV-driven triage, emergency mitigation, and post-patch verification. When you need to understand how web application weaknesses such as XXE fit into common attack paths, Web Application Attacks Guide gives the broader attack-pattern context. For tracking root-cause weakness classes, CWE Top 25 Guide is useful because XXE sits in the same family of input-handling and parser-trust failures that repeatedly reappear across products.

How to confirm exposure and reduce blast radius

Confirm whether any Proself Enterprise, Standard, Gateway, or Mail Sanitize instance is deployed, and then check whether XML is accepted from user-controlled requests, uploads, or integration points. If the product is present but not externally reachable, the risk is lower, but do not assume it is irrelevant: internal services and partner-facing flows can still be abused once an attacker has any foothold.

Where patching is pending, the immediate objective is to remove or constrain the XML handling path that makes the XXE vector reachable. That usually means disabling risky parser features, restricting the exposed interface, and placing compensating controls around the specific request types that can trigger XML parsing. The right mitigation depends on the vendor’s guidance, so defer to the advisory rather than improvising a partial fix.

If the system has already been exposed for some time, look for signs of earlier compromise before and after remediation. For XXE, that means checking for unusual outbound requests, unexpected file reads, parser errors tied to attacker input, and any subsequent access to data or internal services that should not have been reachable from the original request.

What the KEV listing implies for response priority

KEV inclusion changes the decision threshold. Even without a disclosed ransomware link, a KEV-listed flaw should move into active remediation workflow because exploitation is no longer hypothetical. That makes exposure scoping, patch scheduling, and validation more important than debating whether the vulnerability is “serious enough” in abstract terms.

CISA’s catalog entry should be used alongside the vendor advisory to confirm the exact affected product lines and any removal or mitigation steps the vendor recommends. The safe practitioner pattern is to treat KEV status as a trigger for inventory validation, accelerated remediation, and a targeted compromise review rather than waiting for public evidence that your own environment has been hit.

If you need the official tracking sources, follow CISA Known Exploited Vulnerabilities Catalog for exploitation status and due-date guidance, and use NIST National Vulnerability Database for the canonical CVE record and product metadata. The CVE Program remains the source of record for the vulnerability identifier itself.

Risk and Threat Considerations

XXE exploitation can expose more than the vulnerable application, because XML parsers may be used as a bridge into local files, internal resources, or backend systems. Once an attacker can influence entity resolution, the failure can become a confidentiality issue, an internal network discovery path, or a stepping stone to broader compromise.

Failure mechanism: The parser processes attacker-supplied XML in a way that permits external entity resolution or related unsafe reference handling, allowing the attacker to pull in local or remote resources that should never have been reachable from the request.

Impact: The result can be data exposure, internal service probing, or follow-on compromise, especially if the application trusts parser output or uses the same input path for privileged backend workflows.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP ASVS	V4 — API and Web Service Security	XXE is a server-side input handling issue in XML services.
	V15 — Secure Coding and Architecture	XXE reflects unsafe parser design and insecure trust of input data.
Recommendation — Review XML handling in APIs and disable unsafe external entity processing. Harden XML parsing paths and remove unsafe defaults from application architecture.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation demands rapid identification and remediation of affected systems.
Recommendation — Prioritise remediation of KEV-listed exposures and verify closure after patching.
NIST SP 800-53 Rev 5	SI-10 — Information Input Validation	XXE is enabled by inadequate validation and unsafe parsing of external input.
	SI-4 — System Monitoring	Active exploitation requires monitoring for suspicious parser activity and follow-on access.
Recommendation — Validate and constrain XML input before it reaches parser logic. Monitor for anomalous XML parsing behavior and investigate related outbound activity.

Practitioner Guidance

What to prioritise: Prioritise the exposed Proself components that are reachable from untrusted input, then verify whether the parser path is still active after mitigation. If the instance is internet-facing or integrated with external users, treat it as a same-day response item rather than a routine patch.

What to verify: Verify the vendor’s exact remediation guidance, confirm the vulnerable feature is no longer reachable, and review logs for unusual parser activity or outbound connections that predate the fix. If the environment cannot be patched immediately, document the compensating control and the residual exposure window.

Practitioner takeaway: For KEV-listed XXE issues, the key decision is not whether the bug is exploitable in theory, but whether the vulnerable parser path is still reachable today and whether you have already checked for signs of pre-remediation compromise.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org