What is the CVSS score of CVE-2026-44618?

CVE-2026-44618 has a CVSS 3.x base score of 5.3 (N/A). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44618?

Yes, a patch is available for CVE-2026-44618. Update the affected software to the latest version immediately.

Apache Cxf CVE-2026-44618

EUVD-2026-31434

Improper Restriction of XML External Entity Reference (CWE-611)

2026-05-22 apache

GHSA-vmm5-fjgx-2jhp

Apache XXE Apache Cxf

5.3

CVSS · NVD

Severity by source

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 26, 2026 - 14:16 EUVD

CVE Published

May 22, 2026 - 12:17 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.cxf:cxf-rt-ws-transfer (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.2.0.

DescriptionCVE.org

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.