CVE-2018-18406

CVE-2018-18406 is a blind XML External Entity (XXE) vulnerability affecting Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). An attacker, regardless of user privileges, can exploit this by injecting a malicious payload into the XML input field when saving a new Best Practices Report in the Audit Report module. This vulnerability carries a critical CVSS score of 9.9, indicating a low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability, as it allows for the viewing of restricted operating system files. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.