Connext Professional CVE-2026-4374

Successful exploitation requires the target environment to be running one or more of the five affected RTI Connext Professional service components: Routing Service, Observability Collector, Recording Service, Queueing Service, or Cloud Discovery Service. The vulnerable services must be configured to process XML input from network sources, either through configuration file loading, DDS topic data deserialization, or service management interfaces. Network accessibility to the service endpoints is required (AV:N), but no authentication is needed (PR:N) and no user interaction is required (UI:N), enabling fully automated remote exploitation against default configurations. Exploitation is NOT limited by default security settings, making all unpatched deployments with network-exposed services vulnerable. However, environments that have explicitly disabled XML external entity processing through parser hardening or deployed strict input validation would resist exploitation. Organizations using only the core Connext Professional library without the five named service components are not affected by this specific CVE. The low attack complexity (AC:L) indicates attackers need only craft standard XXE payloads without requiring race conditions, complex timing, or environment-specific customization.

Real-world risk assessment reveals moderate practical threat despite high CVSS 8.8 rating. The CVSS:4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity and no authentication, which normally signals critical urgency. However, multiple risk indicators suggest lower immediate priority: EPSS score of 0.04% (11th percentile) indicates extremely low probability of mass exploitation in the wild. CISA SSVC framework classifies this as Exploitation: none (no evidence of active exploitation), Automatable: no (requires targeting specific DDS deployments), and Technical Impact: partial (confidentiality and availability impact only, no integrity compromise per VC:H/VI:N/VA:H). The CVSS vector shows no secondary system impact (SC:N/SI:N/SA:N), limiting lateral movement potential. However, the network attack vector combined with unauthenticated access creates genuine risk in exposed DDS deployments. The vulnerability's presence across five major service components (Routing, Observability, Recording, Queueing, Cloud Discovery) broadens attack surface. Industrial/embedded deployment contexts often lack network segmentation, potentially elevating practical risk beyond EPSS predictions. Vendor-supplied patch availability reduces urgency for organizations with mature patch management. Priority should increase for internet-facing DDS deployments or environments processing untrusted XML data streams.

An attacker identifies an internet-exposed RTI Connext Professional Cloud Discovery Service endpoint processing XML-formatted DDS discovery data. The attacker crafts a malicious XML payload containing external entity declarations that reference internal file paths (file:///etc/passwd) or internal network resources (http://internal-server/secrets). By sending this payload through normal DDS communication channels or service configuration interfaces, the attacker triggers XXE processing. The vulnerable XML parser retrieves and includes the referenced external content, which is then returned in error messages or reflected in service responses, exfiltrating sensitive files. Alternatively, the attacker references extremely large external entities or recursive entity definitions, exhausting parser memory and causing denial of service across the DDS infrastructure. Public exploit code for generic XXE attacks exists (modifying for DDS serialization formats requires minimal effort).