At this page is the specification for XML: Extensible Markup Language (XML) 1.0 (Fifth Edition)
In section 2.4 it states:
The ampersand character (&) and the left angle bracket (<) *MUST NOT* appear in their literal form, except when used as markup delimiters, or within a [comment](https://www.w3.org/TR/xml/#dt-comment), a [processing instruction](https://www.w3.org/TR/xml/#dt-pi), or a [CDATA section](https://www.w3.org/TR/xml/#dt-cdsection). If they are needed elsewhere, they *MUST* be [escaped](https://www.w3.org/TR/xml/#dt-escape) using either [numeric character references](https://www.w3.org/TR/xml/#dt-charref) or the strings " &" and "< " respectively
The reason this is a constraint is because it is impossible to reliably parse XML when a & literal is in element content. You might be able to get lucky, depending upon the specific XML being used, of doing a search/replace but there is a good probability that will fail you at some point in the future. The source system must fix their error.
Side note: try to avoid CDATA sections as a “work-around”. They can be somewhat painful to deal with and are almost never necessary.