diff --git a/fcli-core/fcli-ssc/src/main/java/com/fortify/cli/ssc/action/helper/SSCActionSpelFunctions.java b/fcli-core/fcli-ssc/src/main/java/com/fortify/cli/ssc/action/helper/SSCActionSpelFunctions.java
index a50d2f73c3..7934ca4fc2 100644
--- a/fcli-core/fcli-ssc/src/main/java/com/fortify/cli/ssc/action/helper/SSCActionSpelFunctions.java
+++ b/fcli-core/fcli-ssc/src/main/java/com/fortify/cli/ssc/action/helper/SSCActionSpelFunctions.java
@@ -175,8 +175,9 @@ private final String processFpr(RawResponse r, Function<JsonNode, Boolean> consu
         
         private final void processAuditFvdl(InputStream is, Function<JsonNode, Boolean> consumer) throws XMLStreamException {
             var factory = XMLInputFactory.newInstance();
-            // Disable DTD processing and external entity resolution to prevent XXE attacks
-            factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+            // Allow DTD processing (FVDL rule descriptions may declare internal-only entities,
+            // e.g. &reg;/&trade;), but block resolution of external entities/DTDs to prevent XXE (CWE-611).
+            factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
             factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
             var reader = factory.createXMLStreamReader(is);
             while(reader.hasNext()) {