PT-2026-42754 · Apache · Apache Cxf

Published 2026-05-22 · Updated 2026-05-26 · CVE-2026-44618

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11

Description Insecure XML parser configuration in the WS-Transfer module may allow attackers to perform XML External Entity (XXE) attacks. XXE is a type of attack where an application processes XML input containing a reference to an external entity, potentially leading to unauthorized access to files or internal systems.

Recommendations Upgrade to version 4.2.1. Upgrade to version 4.1.6. Upgrade to version 3.6.11.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-44618

GHSA-VMM5-FJGX-2JHP

Affected Products

Apache Cxf

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44618.json · Exploit
• https://lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44618 · Security Note
• https://osv.dev/vulnerability/GHSA-vmm5-fjgx-2jhp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44618 · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://twitter.com/oss_security/status/2058061804115255675 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/22/8 · Note
• https://repo.maven.apache.org/maven2 · Note
• https://t.me/CVEtracker/54628 · Telegram Post