diff --git a/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java b/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java
index de4ba5268f9d6..431dfdea31917 100644
--- a/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java
+++ b/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020 Oracle and/or its affiliates.
+ * Copyright (c) 2020, 2025, Oracle and/or its affiliates.
  *
  * Licensed under the Universal Permissive License v 1.0 as shown at
  * http://oss.oracle.com/licenses/upl.
@@ -104,6 +104,11 @@ public void populateSchema(Schema schema)
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             dbf.setNamespaceAware(true);
 
+            // prevent XXE (XML External Entity) attacks
+            dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
             DocumentBuilder db        = dbf.newDocumentBuilder();
             Document        doc       = db.parse(m_inputXml);
             Element         root      = doc.getDocumentElement();
diff --git a/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java b/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java
index 01c0c3a4f953a..c73aa3455fe97 100644
--- a/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java
+++ b/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java
@@ -535,6 +535,20 @@ protected static Parser getParser()
                 ClassHelper.invoke(factory,
                     "setValidating", new Object[] {Boolean.FALSE});
 
+                // prevent XXE (XML External Entity) attacks
+                // factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+                ClassHelper.invoke(factory,
+                    "setFeature", new Object[] {
+                        "http://xml.org/sax/features/external-general-entities", Boolean.FALSE});
+                // factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+                ClassHelper.invoke(factory,
+                    "setFeature", new Object[] {
+                        "http://xml.org/sax/features/external-parameter-entities", Boolean.FALSE});
+                // factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+                ClassHelper.invoke(factory,
+                    "setFeature", new Object[] {
+                        "http://apache.org/xml/features/nonvalidating/load-external-dtd", Boolean.FALSE});
+
                 // parser = factory.newSAXParser().getParser();
                 Object SAXParser = ClassHelper.invoke(factory,
                     "newSAXParser", ClassHelper.VOID);