diff --git a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
index aba6042c7ac..a61f152a8fa 100644
--- a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
+++ b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
@@ -18,6 +18,7 @@
 
 import java.io.IOException;
 import java.io.InterruptedIOException;
+import java.net.URI;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
@@ -77,6 +78,12 @@
  *     Parsing and validation errors do not stop the configuration process; they are printed as warnings to the status
  *     logger.
  * </p>
+ * <p>
+ *     Since version <strong>2.27.0</strong>, external entities are resolved through
+ *     {@link ConfigurationSource#fromUri(URI)}, so they can only be retrieved from local files or over the protocols allowed by the
+ *     <a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.configurationAllowedProtocols">{@code log4j2.configurationAllowedProtocols}</a>
+ *     configuration property.
+ * </p>
  */
 public class XmlConfiguration extends Log4j1Configuration {
 
diff --git a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
index a4434e1e703..13f3bf7c49a 100644
--- a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
+++ b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
@@ -360,6 +360,13 @@ and
 xref:manual/configuration.adoc#configuration-attribute-schema[`schema`]
 attributes of the XML configuration format.
 
+[NOTE]
+====
+Since version `2.27.0`, the external subset and other external entities can only be retrieved from local files or over the protocols allowed by the
+xref:manual/systemproperties.adoc#log4j2.configurationAllowedProtocols[`log4j2.configurationAllowedProtocols`]
+property.
+====
+
 [#configuration-appenders]
 ==== Appenders